2309
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
Category-16: Configuration
Category ID : 16
Summary
Weaknesses in this category are typically introduced during the configuration of the software.
Membership
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 933 OWASP Top Ten 2013 Category A5 - Security
Misconfiguration
928 2391
MemberOf 1032 OWASP Top Ten 2017 Category A6 - Security
Misconfiguration
1026 2438
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 14 Server Misconfiguration
WASC 15 Application Misconfiguration
Notes
Maintenance
Further discussion about this category was held over the CWE Research mailing list in early
2020. No definitive action has been decided.
Maintenance
This entry is a Category, but various sources map to it anyway, despite CWE guidance that
Categories should not be mapped. In this case, there are no clear CWE Weaknesses that can
be utilized. "Inappropriate Configuration" sounds more like a Weakness in CWE's style, but it
still does not indicate actual behavior of the product. Further research is still required, however,
as a "configuration weakness" might be Primary to many other CWEs, i.e., it might be better
described in terms of chaining relationships.
References
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
Category-19: Data Processing Errors
Category ID : 19
Summary
Weaknesses in this category are typically found in functionality that processes data. Data
processing is the manipulation of input to retrieve or save information.
Membership
CWE Version 4.14
CWE-133: String Errors
CWE-133: String Errors