cwe2 is a library to handle CWE in Python. CWE are weakness categories for vulnerabilities.
Homepage and support: https://github.com/aboutcode-org/cwe2
See https://cwe.mitre.org/index.html for details on CWE. This is a maintainer fork of https://github.com/Julian-Nash/cwe
It contains a vendored copy of the CWE data.
Copyright (c) Julian-Nash, Ziad Hany, nexB. Inc. and others. SPDX-License-Identifier: MIT and LicenseRef-scancode-cwe-tou
The CWE data has this notice:
Use of the Common Weakness Enumeration (CWE) and the associated references from
this website are subject to the Terms of Use. CWE is sponsored by the U.S.
Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security
Agency (CISA) and managed by the Homeland Security Systems Engineering and
Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE).
Copyright © 2006–2022, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo
are trademarks of The MITRE Corporation.
See cwe-tou.LICENSE for detailsInstall with pip::
pip install cwe2Get a CWE by ID::
from cwe2.database import Database db = Database() db.get(15) Weakness(cwe_id=15, name='External Control of System or Configuration Setting', weakness_abstraction='Base', status='Incomplete', description='One or more system settings or configuration elements can be externally controlled by a user.', extended_description='Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', related_weaknesses='::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', weakness_ordinalities=nan, applicable_platforms=nan, background_details=nan, alternate_terms=nan, modes_of_introduction='::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', exploitation_factors=nan, likelihood_of_exploit=nan, common_consequences='::SCOPE:Other:IMPACT:Varies by Context::', detection_methods=nan, potential_mitigations='::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', observed_examples=nan, functional_areas=nan, affected_resources=nan, taxonomy_mappings='::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', related_attack_patterns='::13::146::176::203::270::271::69::76::77::', notes=nan)
Access attributes of the Weakness using dot notation::
weakness = db.get("15") weakness.description 'One or more system settings or configuration elements can be externally controlled by a user.'
Or use the weakness get method::
weakness.get("status") 'Incomplete'
Get a dictionary of the weakness (Truncated for this example)::
weakness.dict {'cwe_id': 15, 'name': 'External Control of System or Configuration Setting', 'weakness_abstraction': 'Base', 'status': 'Incomplete', 'description': 'One or more system settings or configuration elements can be externally controlled by a user.', 'extended_description': 'Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', 'related_weaknesses': '::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', 'weakness_ordinalities': nan, 'applicable_platforms': nan, 'background_details': nan, 'alternate_terms': nan, 'modes_of_introduction': '::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', 'exploitation_factors': nan, 'likelihood_of_exploit': nan, 'common_consequences': '::SCOPE:Other:IMPACT:Varies by Context::', 'detection_methods': nan, 'potential_mitigations': '::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', 'observed_examples': nan, 'functional_areas': nan, 'affected_resources': nan, 'taxonomy_mappings': '::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', 'related_attack_patterns': '::13::146::176::203::270::271::69::76::77::', 'notes': nan}
Extra functions:
db.get_top_25_cwe()db.get_owasp_top_ten_2021()db.get_weaknesses_used_by_nvd()db.is_cwe_top_25(20)db.is_weaknesses_used_by_nvd(352)db.is_owasp_top_ten_2021(11)The following weakness object attributes can accessed:
cwe_idnameweakness_abstractionstatusdescriptionextended_descriptionrelated_weaknessesweakness_ordinalitiesapplicable_platformsbackground_detailsalternate_termsmodes_of_introductionexploitation_factorslikelihood_of_exploitcommon_consequencesdetection_methodspotential_mitigationsobserved_examplesfunctional_areasaffected_resourcestaxonomy_mappingsrelated_attack_patternsnotesRun the tests with::
make test