=====================================================================
cwe2: CWE / Common weakness enumeration library for Python
=====================================================================
cwe2 is a library to handle CWE in Python. CWE are weakness categories for
vulnerabilities.
Homepage and support: https://github.com/nexB/cwe2
See https://cwe.mitre.org/index.html for details on CWE.
This is a maintainer fork of https://github.com/Julian-Nash/cwe
It contains a vendored copy of the CWE data.
Copyright (c) Julian-Nash, Ziad Hany, nexB. Inc. and others.
SPDX-License-Identifier: MIT and LicenseRef-scancode-cwe-tou
The CWE data has this notice:
Use of the Common Weakness Enumeration (CWE) and the associated references from
this website are subject to the Terms of Use. CWE is sponsored by the U.S.
Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security
Agency (CISA) and managed by the Homeland Security Systems Engineering and
Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE).
Copyright © 2006–2022, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo
are trademarks of The MITRE Corporation.
See cwe-tou.LICENSE for details
Installation
-----------------
Install with pip::
pip install cwe2
Usage
-----------
- Get a CWE by ID::
>>> from cwe2.database import Database
>>> db = Database()
>>> db.get(15)
Weakness(cwe_id=15, name='External Control of System or Configuration Setting', weakness_abstraction='Base', status='Incomplete', description='One or more system settings or configuration elements can be externally controlled by a user.', extended_description='Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', related_weaknesses='::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', weakness_ordinalities=nan, applicable_platforms=nan, background_details=nan, alternate_terms=nan, modes_of_introduction='::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', exploitation_factors=nan, likelihood_of_exploit=nan, common_consequences='::SCOPE:Other:IMPACT:Varies by Context::', detection_methods=nan, potential_mitigations='::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', observed_examples=nan, functional_areas=nan, affected_resources=nan, taxonomy_mappings='::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', related_attack_patterns='::13::146::176::203::270::271::69::76::77::', notes=nan)
- Access attributes of the Weakness using dot notation::
>>> weakness = db.get(15)
>>> weakness.description
'One or more system settings or configuration elements can be externally controlled by a user.'
- Or use the weakness `get` method::
>>> weakness.get("status")
'Incomplete'
- Get a dictionary of the weakness (Truncated for this example)::
>>> weakness.__dict__
{'cwe_id': 15, 'name': 'External Control of System or Configuration Setting', 'weakness_abstraction': 'Base', 'status': 'Incomplete', 'description': 'One or more system settings or configuration elements can be externally controlled by a user.', 'extended_description': 'Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', 'related_weaknesses': '::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', 'weakness_ordinalities': nan, 'applicable_platforms': nan, 'background_details': nan, 'alternate_terms': nan, 'modes_of_introduction': '::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', 'exploitation_factors': nan, 'likelihood_of_exploit': nan, 'common_consequences': '::SCOPE:Other:IMPACT:Varies by Context::', 'detection_methods': nan, 'potential_mitigations': '::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', 'observed_examples': nan, 'functional_areas': nan, 'affected_resources': nan, 'taxonomy_mappings': '::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', 'related_attack_patterns': '::13::146::176::203::270::271::69::76::77::', 'notes': nan}
- Get the top 25 weaknesses `get_top_25_cwe`
- Get the top ten OWASP 2021 weaknesses `get_owasp_top_ten_2021`::
>>> from cwe2.database import Database
>>> db = Database()
>>> db.get_top_25_cwe()
- Is in a OWASP Top Ten (2021) `is_owasp_top_ten_2021`
- Is in a CWE Top 25 (2022) `is_cwe_top_25`::
>>> from cwe2.database import Database
>>> db = Database()
>>> db.is_owasp_top_ten_2021(11)
True
>>> db.is_cwe_top_25(11)
False
Weakness attributes
---------------------------------
The following weakness object attributes can accessed:
- `cwe_id`
- `name`
- `weakness_abstraction`
- `status`
- `description`
- `extended_description`
- `related_weaknesses`
- `weakness_ordinalities`
- `applicable_platforms`
- `background_details`
- `alternate_terms`
- `modes_of_introduction`
- `exploitation_factors`
- `likelihood_of_exploit`
- `common_consequences`
- `detection_methods`
- `potential_mitigations`
- `observed_examples`
- `functional_areas`
- `affected_resources`
- `taxonomy_mappings`
- `related_attack_patterns`
- `notes`
Tests
----------------------
Run the tests with::
pytest
Raw data
{
"_id": null,
"home_page": "https://github.com/nexB/cwe2",
"name": "cwe2",
"maintainer": "",
"docs_url": null,
"requires_python": ">=3.6.*",
"maintainer_email": "",
"keywords": "utilities,CWE,weakness,CVE,vulnerabilities",
"author": "Ziad Hany, nexB. Inc. and others. Originally based on Julian Nash cwe.",
"author_email": "info@aboutcode.org",
"download_url": "https://files.pythonhosted.org/packages/70/b4/a7b34492664a6de3dfad9cfe3dd536c3e77f3cab2a1f87fa1bce0d9217ab/cwe2-2.0.0.tar.gz",
"platform": null,
"description": "=====================================================================\ncwe2: CWE / Common weakness enumeration library for Python\n=====================================================================\n\ncwe2 is a library to handle CWE in Python. CWE are weakness categories for\nvulnerabilities.\n\nHomepage and support: https://github.com/nexB/cwe2\n\nSee https://cwe.mitre.org/index.html for details on CWE.\nThis is a maintainer fork of https://github.com/Julian-Nash/cwe\n\nIt contains a vendored copy of the CWE data.\n\nCopyright (c) Julian-Nash, Ziad Hany, nexB. Inc. and others. \nSPDX-License-Identifier: MIT and LicenseRef-scancode-cwe-tou\n\nThe CWE data has this notice:\n\n Use of the Common Weakness Enumeration (CWE) and the associated references from\n this website are subject to the Terms of Use. CWE is sponsored by the U.S.\n Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security\n Agency (CISA) and managed by the Homeland Security Systems Engineering and\n Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE).\n Copyright \u00a9 2006\u20132022, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo\n are trademarks of The MITRE Corporation.\n See cwe-tou.LICENSE for details\n\nInstallation\n-----------------\n\nInstall with pip::\n\n pip install cwe2\n\nUsage\n-----------\n\n- Get a CWE by ID::\n\n >>> from cwe2.database import Database\n >>> db = Database()\n >>> db.get(15)\n Weakness(cwe_id=15, name='External Control of System or Configuration Setting', weakness_abstraction='Base', status='Incomplete', description='One or more system settings or configuration elements can be externally controlled by a user.', extended_description='Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', related_weaknesses='::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', weakness_ordinalities=nan, applicable_platforms=nan, background_details=nan, alternate_terms=nan, modes_of_introduction='::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', exploitation_factors=nan, likelihood_of_exploit=nan, common_consequences='::SCOPE:Other:IMPACT:Varies by Context::', detection_methods=nan, potential_mitigations='::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', observed_examples=nan, functional_areas=nan, affected_resources=nan, taxonomy_mappings='::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', related_attack_patterns='::13::146::176::203::270::271::69::76::77::', notes=nan)\n\n- Access attributes of the Weakness using dot notation::\n\n >>> weakness = db.get(15)\n >>> weakness.description\n 'One or more system settings or configuration elements can be externally controlled by a user.'\n\n- Or use the weakness `get` method::\n\n >>> weakness.get(\"status\")\n 'Incomplete'\n\n- Get a dictionary of the weakness (Truncated for this example)::\n\n >>> weakness.__dict__\n {'cwe_id': 15, 'name': 'External Control of System or Configuration Setting', 'weakness_abstraction': 'Base', 'status': 'Incomplete', 'description': 'One or more system settings or configuration elements can be externally controlled by a user.', 'extended_description': 'Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.', 'related_weaknesses': '::NATURE:ChildOf:CWE ID:642:VIEW ID:1000:ORDINAL:Primary::NATURE:ChildOf:CWE ID:610:VIEW ID:1000::NATURE:ChildOf:CWE ID:20:VIEW ID:700:ORDINAL:Primary::', 'weakness_ordinalities': nan, 'applicable_platforms': nan, 'background_details': nan, 'alternate_terms': nan, 'modes_of_introduction': '::PHASE:Implementation:NOTE:Setting manipulation vulnerabilities occur when an attacker can control values that govern the behavior of the system, manage specific resources, or in some way affect the functionality of the application.::PHASE:Implementation:NOTE:REALIZATION: This weakness is caused during implementation of an architectural security tactic.::', 'exploitation_factors': nan, 'likelihood_of_exploit': nan, 'common_consequences': '::SCOPE:Other:IMPACT:Varies by Context::', 'detection_methods': nan, 'potential_mitigations': '::PHASE:Architecture and Design:STRATEGY:Separation of Privilege:DESCRIPTION:Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.::PHASE:Implementation Architecture and Design:DESCRIPTION:Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.::PHASE:Implementation Architecture and Design:DESCRIPTION:In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.::', 'observed_examples': nan, 'functional_areas': nan, 'affected_resources': nan, 'taxonomy_mappings': '::TAXONOMY NAME:7 Pernicious Kingdoms:ENTRY NAME:Setting Manipulation::TAXONOMY NAME:Software Fault Patterns:ENTRY ID:SFP25:ENTRY NAME:Tainted input to variable::', 'related_attack_patterns': '::13::146::176::203::270::271::69::76::77::', 'notes': nan}\n\n- Get the top 25 weaknesses `get_top_25_cwe`\n- Get the top ten OWASP 2021 weaknesses `get_owasp_top_ten_2021`::\n\n >>> from cwe2.database import Database\n >>> db = Database()\n >>> db.get_top_25_cwe()\n\n- Is in a OWASP Top Ten (2021) `is_owasp_top_ten_2021`\n- Is in a CWE Top 25 (2022) `is_cwe_top_25`::\n\n >>> from cwe2.database import Database\n >>> db = Database()\n >>> db.is_owasp_top_ten_2021(11)\n True\n >>> db.is_cwe_top_25(11)\n False\n\nWeakness attributes\n---------------------------------\n\nThe following weakness object attributes can accessed:\n\n- `cwe_id`\n- `name`\n- `weakness_abstraction`\n- `status`\n- `description`\n- `extended_description`\n- `related_weaknesses`\n- `weakness_ordinalities`\n- `applicable_platforms`\n- `background_details`\n- `alternate_terms`\n- `modes_of_introduction`\n- `exploitation_factors`\n- `likelihood_of_exploit`\n- `common_consequences`\n- `detection_methods`\n- `potential_mitigations`\n- `observed_examples`\n- `functional_areas`\n- `affected_resources`\n- `taxonomy_mappings`\n- `related_attack_patterns`\n- `notes`\n\nTests\n----------------------\n\nRun the tests with::\n\n pytest\n\n",
"bugtrack_url": null,
"license": "MIT and LicenseRef-scancode-cwe-tou",
"summary": "cwe2 is a CWE common weakness enumeration library for Python",
"version": "2.0.0",
"split_keywords": [
"utilities",
"cwe",
"weakness",
"cve",
"vulnerabilities"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "df860234eeca2487fd7d189ff73d327d34727393a42ccb74cf60813e36e400ae",
"md5": "8e47cdd361f71672ccb588f846569978",
"sha256": "4443eca427c052066dcf67b1b0d1a84530ac9c152fa6bd6dfd8347d30b9e8a06"
},
"downloads": -1,
"filename": "cwe2-2.0.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "8e47cdd361f71672ccb588f846569978",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.6.*",
"size": 1164282,
"upload_time": "2022-11-21T19:52:08",
"upload_time_iso_8601": "2022-11-21T19:52:08.997219Z",
"url": "https://files.pythonhosted.org/packages/df/86/0234eeca2487fd7d189ff73d327d34727393a42ccb74cf60813e36e400ae/cwe2-2.0.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "70b4a7b34492664a6de3dfad9cfe3dd536c3e77f3cab2a1f87fa1bce0d9217ab",
"md5": "c50b678e052b08db608247f67e2de5cd",
"sha256": "cfdb9b7940f0a7e2c439759d5371f5ed6e44c38233001ee554b738ba4ad2487b"
},
"downloads": -1,
"filename": "cwe2-2.0.0.tar.gz",
"has_sig": false,
"md5_digest": "c50b678e052b08db608247f67e2de5cd",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.6.*",
"size": 1212989,
"upload_time": "2022-11-21T19:52:12",
"upload_time_iso_8601": "2022-11-21T19:52:12.898285Z",
"url": "https://files.pythonhosted.org/packages/70/b4/a7b34492664a6de3dfad9cfe3dd536c3e77f3cab2a1f87fa1bce0d9217ab/cwe2-2.0.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2022-11-21 19:52:12",
"github": true,
"gitlab": false,
"bitbucket": false,
"github_user": "nexB",
"github_project": "cwe2",
"travis_ci": false,
"coveralls": false,
"github_actions": true,
"requirements": [],
"lcname": "cwe2"
}
JSON
