> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/vulnerability-classification/cwe.md).

# CWE

CWE is a **catalog of software and hardware weaknesses** that can lead to vulnerabilities. Unlike CVE, which tracks **specific vulnerabilities**, CWE focuses on **the root causes or coding/design flaws** that make systems vulnerable.

Think of it like:

* **CWE = the “weakness”**
* **CVE = the “actual attackable problem”**

***

#### **CWE Structure**

* CWE entries are **numbered**, like `CWE-79` (Cross-Site Scripting).
* Each entry includes:
  * **Name of the weakness** (e.g., SQL Injection, Buffer Overflow)
  * **Description**
  * **Consequences** (what can happen if exploited)
  * **Mitigation guidance**

***

#### **Examples of Common CWEs**

| CWE ID  | Weakness Name              | Description                                                                       |
| ------- | -------------------------- | --------------------------------------------------------------------------------- |
| CWE-79  | Cross-Site Scripting (XSS) | User input is not properly sanitized, allowing scripts to execute in the browser. |
| CWE-89  | SQL Injection              | Improper input validation allows SQL queries to be manipulated.                   |
| CWE-120 | Buffer Overflow            | Memory buffer boundaries are exceeded, leading to crashes or code execution.      |

***

#### **How CWE relates to CVE**

* **CWE = category/type of weakness**
* **CVE = actual instance of a vulnerability**

**Example:**

* CWE-89 = SQL Injection (the weakness type)
* CVE-2024-12345 = SQL Injection found in a specific version of a web application

***

#### **Why CWE is Useful**

* **Developers:** Learn secure coding practices.
* **Security teams:** Prioritize weaknesses that are most likely to be exploited.
* **Auditors:** Check if the software is prone to common weaknesses.
* **Organizations:** Track recurring patterns in their products for risk management.

***

#### **Reference**

* <https://hackerone.com/hacktivity/cwe\\_discovery>
* <https://cwe.mitre.org>