These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction.
This table shows the weaknesses and high level categories that are related to this weakness. Improper Restriction of Operations within the Bounds of a Memory Buffer Improper Validation of Specified Type of Input Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. That is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. More specific than a Pillar Weakness, but more general than a Base Weakness. While a composite is a set of weaknesses that must all be present simultaneously in order to produce an exploitable vulnerability.Ĭlass - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. A chain is a set of weaknesses that must be reachable consecutively in order to produce an exploitable vulnerability. A variant is a weakness that is described at a very low level of detail, typically limited to a specific language or technology. Base level weaknesses are used to present a more specific type of weakness.
Classes are still very abstract, typically independent of any specific language or technology. Below these top-level entries are weaknesses are varying levels of abstraction. Pillars are weaknesses that are described in the most abstract fashion.
Categories (which are not technically weaknesses) are special CWE entries used to group weaknesses that share a common characteristic. At the highest level, categories and pillars exist to group weaknesses. The following graph shows the tree-like relationships between weaknesses that exist at different levels of abstraction.
0 kommentar(er)
