Skip to main content

cwe2 is a CWE common weakness enumeration library for Python

Project description

cwe2 is a library to handle CWE in Python. CWE are weakness categories for vulnerabilities.

Homepage and support: https://github.com/nexB/cwe2

See https://cwe.mitre.org/index.html for details on CWE. This is a maintainer fork of https://github.com/Julian-Nash/cwe

It contains a vendored copy of the CWE data.

Copyright (c) Julian-Nash, Ziad Hany, nexB. Inc. and others. SPDX-License-Identifier: MIT and LicenseRef-scancode-cwe-tou

The CWE data has this notice:

Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2022, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. See cwe-tou.LICENSE for details

Installation

Install with pip:

pip install cwe2

Usage

  • Get a CWE by ID:

    >>> from cwe2.database import Database
    >>> db = Database()
    >>> db.get(15)
    Weakness(cwe_id=15, name='External Control of System or Configuration Setting', weakness_abstraction='Base', status='Incomplete', description='One or more system settings or configuration elements can be externally controlled by a user.', extended_description='Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', related_weaknesses='::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', weakness_ordinalities=nan, applicable_platforms=nan, background_details=nan, alternate_terms=nan, modes_of_introduction='::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', exploitation_factors=nan, likelihood_of_exploit=nan, common_consequences='::SCOPE:Other:IMPACT:Varies by Context::', detection_methods=nan, potential_mitigations='::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', observed_examples=nan, functional_areas=nan, affected_resources=nan, taxonomy_mappings='::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', related_attack_patterns='::13::146::176::203::270::271::69::76::77::', notes=nan)
  • Access attributes of the Weakness using dot notation:

    >>> weakness = db.get("15")
    >>> weakness.description
    'One or more system settings or configuration elements can be externally controlled by a user.'
  • Or use the weakness get method:

    >>> weakness.get("status")
    'Incomplete'
  • Get a dictionary of the weakness (Truncated for this example):

    >>> weakness.__dict__
    {'cwe_id': 15, 'name': 'External Control of System or Configuration Setting', 'weakness_abstraction': 'Base', 'status': 'Incomplete', 'description': 'One or more system settings or configuration elements can be externally controlled by a user.', 'extended_description': 'Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', 'related_weaknesses': '::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', 'weakness_ordinalities': nan, 'applicable_platforms': nan, 'background_details': nan, 'alternate_terms': nan, 'modes_of_introduction': '::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', 'exploitation_factors': nan, 'likelihood_of_exploit': nan, 'common_consequences': '::SCOPE:Other:IMPACT:Varies by Context::', 'detection_methods': nan, 'potential_mitigations': '::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', 'observed_examples': nan, 'functional_areas': nan, 'affected_resources': nan, 'taxonomy_mappings': '::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', 'related_attack_patterns': '::13::146::176::203::270::271::69::76::77::', 'notes': nan}

Extra functions:

  • Get the top 25 weaknesses db.get_top_25_cwe()

  • Get the top ten OWASP 2021 weaknesses db.get_owasp_top_ten_2021()

  • Get the weaknesses used by nvd db.get_weaknesses_used_by_nvd()

  • Is in a CWE Top 25 (2022) db.is_cwe_top_25(20)

  • Is weaknesses used by nvd db.is_weaknesses_used_by_nvd(352)

  • Is in a OWASP Top Ten (2021) db.is_owasp_top_ten_2021(11)

Weakness attributes

The following weakness object attributes can accessed:

  • cwe_id

  • name

  • weakness_abstraction

  • status

  • description

  • extended_description

  • related_weaknesses

  • weakness_ordinalities

  • applicable_platforms

  • background_details

  • alternate_terms

  • modes_of_introduction

  • exploitation_factors

  • likelihood_of_exploit

  • common_consequences

  • detection_methods

  • potential_mitigations

  • observed_examples

  • functional_areas

  • affected_resources

  • taxonomy_mappings

  • related_attack_patterns

  • notes

Tests

Run the tests with:

make test

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cwe2-3.0.0.tar.gz (8.9 MB view details)

Uploaded Source

Built Distribution

cwe2-3.0.0-py3-none-any.whl (9.0 MB view details)

Uploaded Python 3

File details

Details for the file cwe2-3.0.0.tar.gz.

File metadata

  • Download URL: cwe2-3.0.0.tar.gz
  • Upload date:
  • Size: 8.9 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/5.1.1 CPython/3.9.10

File hashes

Hashes for cwe2-3.0.0.tar.gz
Algorithm Hash digest
SHA256 cfdcea629e45dfcd2cdc54ef26b3ad6e30dc794575eebb57eeffc59718dd49bb
MD5 fee9e6bf4c2cc7c5636bbdff681d68c8
BLAKE2b-256 18ce65fd8fb718b8d7ff6c4d3feadcc9c285bb3595d2bb5ebb1d37856969ce39

See more details on using hashes here.

Provenance

File details

Details for the file cwe2-3.0.0-py3-none-any.whl.

File metadata

  • Download URL: cwe2-3.0.0-py3-none-any.whl
  • Upload date:
  • Size: 9.0 MB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/5.1.1 CPython/3.9.10

File hashes

Hashes for cwe2-3.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 abef03eb853f5c1851df6af5167bd9fe73a53dddb119fdbc5c3afc7d50b9f55b
MD5 08a7b8e6c7c5a7838061343fc3da8e33
BLAKE2b-256 a1f3444e2c5c5e7caf86dee85e26e5261e3098b3ede59a7916b2c9dfbba838dc

See more details on using hashes here.

Provenance

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page