Common Weakness Enumeration (CWE).

What is CWE?

CWE stands for Common Weakness Enumeration. The CWE program describes it as a community-developed list of common software and hardware weaknesses. It defines a weakness as a condition in a software, firmware, hardware or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities.

NIST glossary entries describe CWE as a taxonomy for identifying the common sources of software flaws, with buffer overflows and failure to check input data as examples. A taxonomy is an organized system of categories. Another NIST entry calls it a list of known poor coding practices that may be present in software.

How does CWE work?

Each type of weakness gets its own entry in the list, so builders and testers can use the same names for the same kinds of mistake. The CWE site says the goal is to help developers and designers identify and eliminate weaknesses before deployment, and that this is far less costly than dealing with vulnerabilities after release.

CWE says it is sponsored by the United States Cybersecurity and Infrastructure Security Agency (CISA). It says the program is managed by the Homeland Security Systems Engineering and Development Institute, which is operated by The MITRE Corporation.

Why does it matter?

A weakness is the root cause, and a vulnerability is what can follow from it. If a team knows the weakness types it keeps producing, it can look for them earlier, in design and review. The CWE program says it publishes an annual list of the most dangerous weaknesses, which can help teams decide where to look first. Using common names can also make code reviews, test reports and training easier to compare.

How can you use CWE to reduce risk?

CWE is a reference list, so the benefit comes from how you use it. These are general ideas drawn from the stated goal.

• Use CWE names when you write down findings from code review or testing.
• Check the annual list of most dangerous weaknesses when you plan reviews and training.
• Look for the same weakness type across your code, not only the single flaw that was reported.

These are general habits and not a full program.

Is a CWE the same as a CVE?

No. A CWE names a type of weakness, such as a kind of coding mistake. A CVE names one specific publicly known vulnerability in a specific product. In simple terms, CWE is the kind of mistake and CVE is one real case.

Is a CWE the same as a vulnerability?

No. The CWE program says a weakness could contribute to the introduction of vulnerabilities. A weakness alone is not always a flaw that attackers can use. Related terms are CVE and vulnerability management.

Related pages in the Knowledge Hub

• Vulnerability intelligence

Sources

• MITRE CWE: CWE is a community-developed list of common software and hardware weaknesses; defines a weakness; goal is to eliminate weaknesses before deployment; sponsored by CISA….
• NIST: NIST glossary describes CWE as a taxonomy for identifying common sources of software flaws and as a list of known poor coding practices.