{"id":403108,"date":"2024-06-29T16:55:19","date_gmt":"2024-06-29T16:55:19","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=403108"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=403108","title":{"rendered":"CWE Top 25 2021. What is it, what is it for and how is it useful for static analysis?<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

For the first time PVS-Studio provided support for the CWE classification in the 6.21 release. It took place on January 15, 2018. Years have passed since then and we would like to tell you about the improvements related to the support of this classification in the latest analyzer version.<\/p>\n

<\/p>\n

\"https:\/\/import.viva64.com\/docx\/blog\/0869_CWE_status\/image1.png\" <\/p>\n

<\/a> <\/p>\n

We position the PVS-Studio analyzer as a Static Application Security Testing (SAST) tool. This means our analyzer not only detects typos and errors in code, but also searches for potential vulnerabilities<\/a> and correlates them with various standards (CWE, OWASP, SEI CERT, MISRA, AUTOSAR, etc.). Why potential vulnerabilities? Because potential vulnerabilities (CWE) may become real vulnerabilities (CVE) only if someone exploits them. And to make it happen many, sometimes unrelated, factors must often coincide.<\/p>\n

<\/p>\n

That’s why we decided to check how well PVS-Studio covers the most common defects now. To do this, it’s enough to refer to the CWE Top 25 list. Somehow, we missed this list. Well, it’s time to make amends! <\/p>\n

<\/p>\n

CWE. What this is and what it is for<\/h2>\n

<\/p>\n

Let’s refresh some moments and definitions in memory. If you’re already good at terminology and know the difference between CVE and CWE, why we need CVSS and how CWE Top 25 is ranked, you can skip this part. Otherwise, I strongly recommend that you refresh those terms before you read the article. Below is a rather free interpretation of some points of CWE FAQ<\/a> and CVE FAQ<\/a>:<\/p>\n

<\/p>\n

How does a software defect differ from a software vulnerability?<\/strong> <\/p>\n

<\/p>\n

Defects are errors, failures and other problems of implementation, design or architecture of the software that can lead to vulnerabilities.<\/p>\n

<\/p>\n

Vulnerabilities are errors that have already been found by someone. Attackers may use these vulnerabilities to get access to a system or a network, to disrupt services, etc.<\/p>\n

<\/p>\n

What is CWE? How is it different from CVE and what does CVSS have to do with it?<\/strong> <\/p>\n

<\/p>\n