CWE (一般的 Weakness Enumeration) リファレンス
リファレンス 用 MITRE CWE weakness 型, IDs, および relationships 用 vulnerability classification.
CWE Structure
CWE is a community-developed catalog of software weakness types, each with a unique ID. Weaknesses are organized in a hierarchy with parent-child relationships (View, Category, Weakness, Variant). Each CWE includes description, applicability, consequences, detection methods, and mitigation. CWE-79 is XSS, CWE-89 is SQL Injection, CWE-20 is Improper Input Validation. The catalog enables consistent vulnerability classification across tools and reports.
- CWE-79
- Cross-site Scripting
- CWE-89
- SQL Injection
- CWE-20
- Improper Input Validation
XSSSQLiroot causeUsage and Mapping
CWEs map to OWASP Top 10, WASC, and CAPEC attack patterns. CVE entries reference CWEs to classify reported vulnerabilities. SAST and DAST tools report findings with CWE IDs. CWE views organize weaknesses by perspective (e.g., research, development). The CWE Top 25 lists the most dangerous weaknesses. Proper CWE mapping aids prioritization and trend analysis. CWE-1000 is the research view; CWE-699 is the development view.
- CVE mapping
- Vulnerabilities reference CWEs
- tools
- SAST/DAST report CWEs
- Top 25
- Most dangerous
classificationfinding IDsprioritization