May 29, 2023

The MITRE shared the list of the 2022 top 25 most common and dangerous weaknesses, it could help organizations to assess internal infrastructure and determine their surface of attack.

MITRE created the 2022 CWE Top 25 list leveraging Common Vulnerabilities and Exposures data found within the National Institute of Standards and Technology and National Vulnerability Database and the Common Vulnerability Scoring System scores associated with each vulnerability. The organization also used CVE Records from the CISA) Known Exploited Vulnerabilities Catalog and applied a formula to score each weakness based on prevalence and severity.

Advertisements

The dataset analyzed by MITRE researchers to calculate the 2022 Top 25 contained a total of 37,899 CVE Records from the previous two calendar years.

Upward Movers List:

  • CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)): from #33 to #22
  • CWE-94 (Improper Control of Generation of Code (‘Code Injection’)): from #28 to #25
  • CWE-400 (Uncontrolled Resource Consumption): from #27 to #23
  • CWE-77 (Improper Neutralization of Special Elements used in a Command (‘Command Injection’)): from #25 to #17
  • CWE-476 (NULL Pointer Dereference): from #15 to #11

Downward Movers List:

  • CWE-306 (Missing Authentication for Critical Function): from #11 to #18
  • CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): from #20 to #33
  • CWE-522 (Insufficiently Protected Credentials): from #21 to #38
  • CWE-732 (Incorrect Permission Assignment for Critical Resource): from #22 to #30

New Comers:

  • CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)): from #33 to #22
  • CWE-94 (Improper Control of Generation of Code (‘Code Injection’)): from #28 to #25
  • CWE-400 (Uncontrolled Resource Consumption): from #27 to #23
Advertisements

Out of Top 25:

  • CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): from #20 to #33
  • CWE-522 (Insufficiently Protected Credentials): from #21 to #38
  • CWE-732 (Incorrect Permission Assignment for Critical Resource): from #22 to #30
RankIDNameScoreKEV Count (CVEs)Rank Change vs. 2021
1CWE-787Out-of-bounds Write64.20620
2CWE-79Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)45.9720
3CWE-89Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)22.117+3 
4CWE-20Improper Input Validation20.63200
5CWE-125Out-of-bounds Read17.671-2 
6CWE-78Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)17.5332-1 
7CWE-416Use After Free15.50280
8CWE-22Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)14.08190
9CWE-352Cross-Site Request Forgery (CSRF)11.5310
10CWE-434Unrestricted Upload of File with Dangerous Type9.5660
11CWE-476NULL Pointer Dereference7.150+4 
12CWE-502Deserialization of Untrusted Data6.687+1 
13CWE-190Integer Overflow or Wraparound6.532-1 
14CWE-287Improper Authentication6.3540
15CWE-798Use of Hard-coded Credentials5.660+1 
16CWE-862Missing Authorization5.531+2 
17CWE-77Improper Neutralization of Special Elements used in a Command (‘Command Injection’)5.425+8 
18CWE-306Missing Authentication for Critical Function5.156-7 
19CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer4.856-2 
20CWE-276Incorrect Default Permissions4.840-1 
21CWE-918Server-Side Request Forgery (SSRF)4.278+3 
22CWE-362Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’)3.576+11 
23CWE-400Uncontrolled Resource Consumption3.562+4 
24CWE-611Improper Restriction of XML External Entity Reference3.380-1 
25CWE-94Improper Control of Generation of Code (‘Code Injection’)3.324+3 

Leave a Reply

%d bloggers like this: