CWE Version 4.14 has been posted on the CWE List page and includes a number of exciting updates. There are 4 new weakness entries related to related to hardware micro architectures; 1 new View for “Weaknesses Addressed by ISA/IEC 62443 Requirements” for industrial automation and control systems; updates to observed and demonstrative examples; 10 new demonstrative examples from the HACK@DAC security challenge contest; among other changes.
Also, a major enhancement has been made to CWE entry pages beginning with this release. All CWE entry web pages will now have vulnerability mapping labels underneath their titles. These include labels for when a CWE is approved, discouraged, or prohibited from vulnerability root cause mapping. In addition, the labels provide a direct link to the entry’s Mapping Notes for quick reference to more detailed information.
The CWE Program thanks Intel, AMD, ARM, Cycuity, Riscure, HACK@DAC contributors from Texas A&M University and Technical University of Darmstadt, and members of the CWE ICS/OT Special Interest Group (ICS/OT SIG) and Hardware CWE Special Interest Group (HW CWE SIG) for their collaboration preparing for this new version.
Main Changes