This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10-2017 Release Notes"
(Prepare OWASP Top 10-2017 Release (Content)) |
m (Editorial changes (table, 'A1-')) |
||
Line 16: | Line 16: | ||
===New issues, supported by data=== | ===New issues, supported by data=== | ||
− | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}|A4:2017-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}]]</u></b> is a new category primarily supported by | + | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}|A4:2017-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}]]</u></b> is a new category primarily supported by (<u>[[Source_Code_Analysis_Tools|source code analysis security testing tools]]</u> (SAST) data sets. |
===New issues, supported by the community=== | ===New issues, supported by the community=== | ||
Line 24: | Line 24: | ||
===Merged or retired, but not forgotten=== | ===Merged or retired, but not forgotten=== | ||
− | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}|A4 | + | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}|A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}]]</u></b> and <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}|A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}]]</u></b> merged into <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2017}}|A5:2017-{{Top_10_2010:ByTheNumbers|5|language=en|year=2017}}]]</u></b>. |
− | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}|A8 | + | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}|A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}]]</u></b>, as many frameworks include <u>[[Cross-Site_Request_Forgery_(CSRF)|CSRF defenses]]</u>, it was found in only 5% of applications. |
− | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}|A10 | + | * <b><u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}|A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}]]</u></b>, while found in approximately in 8% of applications, it was edged out overall by XXE. |
{{Top_10:SubsectionTableEndTemplate}} | {{Top_10:SubsectionTableEndTemplate}} | ||
<center> | <center> | ||
− | {| style="width: 99%; align:center; text-align: | + | {| style="width: 99%; align:center; text-align:left; border: 2px solid #4a1647; background-color:#F2F2F2; padding=2;" |
− | |- style="background-color: #4a1647; color: #FFFFFF;" | + | |- style="background-color: #4a1647; color: #FFFFFF; text-align:center;" |
− | ! OWASP Top 10 - 2013 (Previous Version) !! OWASP Top 10 - 2017 (Current Version) | + | ! OWASP Top 10 - 2013 (Previous Version) !! <b>⇒</b> !! OWASP Top 10 - 2017 (Current Version) |
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2013}}|A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2013}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2013}}|A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2013}}]]</u> | ||
+ | | style="font-size:120%; text-align:center;" | <b>⇒</b> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2017}}|A1:2017-{{Top_10_2010:ByTheNumbers|1|language=en|year=2017}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2017}}|A1:2017-{{Top_10_2010:ByTheNumbers|1|language=en|year=2017}}]]</u> | ||
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2013}}|A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2013}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2013}}|A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2013}}]]</u> | ||
+ | | style="font-size:120%; text-align:center;" | <b>⇒</b> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2017}}|A2:2017-{{Top_10_2010:ByTheNumbers|2|language=en|year=2017}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2017}}|A2:2017-{{Top_10_2010:ByTheNumbers|2|language=en|year=2017}}]]</u> | ||
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2013}}|A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2013}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2013}}|A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2013}}]]</u> | ||
+ | | style="font-size:120%; text-align:center;" | <b>⇘</b> <!--- decreased risk ---> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2017}}|A3:2017-{{Top_10_2010:ByTheNumbers|3|language=en|year=2017}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2017}}|A3:2017-{{Top_10_2010:ByTheNumbers|3|language=en|year=2017}}]]</u> | ||
|- style="background-color: #F2F1FF;" | |- style="background-color: #F2F1FF;" | ||
− | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}|A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}]]</u> - Merged | + | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}|A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}]]</u> - [Merged + A7] |
+ | | style="font-size:120%; text-align:center; background-color: #FFFFFF;" | <b>∪</b> <!--- merged ---> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}|A4:2017-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}]]</u> [NEW] | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}|A4:2017-{{Top_10_2010:ByTheNumbers|4|language=en|year=2017}}]]</u> [NEW] | ||
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2013}}|A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2013}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2013}}|A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2013}}]]</u> | ||
− | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2017}}|A5:2017-{{Top_10_2010:ByTheNumbers|5|language=en|year=2017}}]]</u> [Merged] | + | | style="font-size:120%; text-align:center;" | <b>⇘</b> <!--- decreased risk ---> |
+ | | style="background-color: #F2F1FF;" | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2017}}|A5:2017-{{Top_10_2010:ByTheNumbers|5|language=en|year=2017}}]]</u> [Merged] | ||
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}|A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}|A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}]]</u> | ||
+ | | style="font-size:120%; text-align:center;" | <b>⇗</b> <!--- increased risk ---> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2017}}|A6:2017-{{Top_10_2010:ByTheNumbers|6|language=en|year=2017}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2017}}|A6:2017-{{Top_10_2010:ByTheNumbers|6|language=en|year=2017}}]]</u> | ||
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
− | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}|A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}]]</u> - Merged | + | | style="background-color: #F2F1FF;" | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}|A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}]]</u> - [Merged + A4] |
+ | | style="font-size:120%; text-align:center;" | <b>∪</b><!--- merged ---> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2017}}|A7:2017-{{Top_10_2010:ByTheNumbers|7|language=en|year=2017}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2017}}|A7:2017-{{Top_10_2010:ByTheNumbers|7|language=en|year=2017}}]]</u> | ||
|- style="background-color: #F2F1FF;" | |- style="background-color: #F2F1FF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}|A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}]]</u> [Dropped] | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}|A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}]]</u> [Dropped] | ||
+ | | style="font-size:120%; text-align:center; background-color: #FFFFFF;" | <b>☒</b> <!--- dropped risk ---> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2017}}|A8:2017-{{Top_10_2010:ByTheNumbers|8|language=en|year=2017}}]]</u> [NEW, Community] | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2017}}|A8:2017-{{Top_10_2010:ByTheNumbers|8|language=en|year=2017}}]]</u> [NEW, Community] | ||
|- style="background-color: #FFFFFF;" | |- style="background-color: #FFFFFF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2013}}|A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2013}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2013}}|A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2013}}]]</u> | ||
+ | | style="font-size:120%; text-align:center;" | <b>⇒</b> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2017}}|A9:2017-{{Top_10_2010:ByTheNumbers|9|language=en|year=2017}}]]</u> | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2017}}|A9:2017-{{Top_10_2010:ByTheNumbers|9|language=en|year=2017}}]]</u> | ||
|- style="background-color: #F2F1FF;" | |- style="background-color: #F2F1FF;" | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}|A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}]]</u> [Dropped] | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}|A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}]]</u> [Dropped] | ||
+ | | style="font-size:120%; text-align:center; background-color: #FFFFFF;" | <b>☒</b> <!--- dropped risk ---> | ||
| <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2017}}|A10:2017-{{Top_10_2010:ByTheNumbers|10|language=en|year=2017}}]]</u> [NEW, Community] | | <u>[[{{Top_10:LanguageFile|text=documentRootTop10New|year=2017|language=en}}_A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2017}}|A10:2017-{{Top_10_2010:ByTheNumbers|10|language=en|year=2017}}]]</u> [NEW, Community] | ||
|} | |} |
Revision as of 12:33, 22 December 2017
What changed from 2013 to 2017?
Change has accelerated over the last four years, and the OWASP Top 10 needed to change. We've completely refactored the OWASP Top 10, revamped the methodology, utilized a new data call process, worked with the community, re-ordered our risks, re-written each risk from the ground up, and added references to frameworks and languages that are now commonly used. Over the last few years, the fundamental technology and architecture of applications has changed significantly:
New issues, supported by data
New issues, supported by the communityWe asked the community to provide insight into two forward looking weakness categories. After over 500 peer submissions, and removing issues that were already supported by data (such as Sensitive Data Exposure and XXE), the two new issues are:
Merged or retired, but not forgotten
|
OWASP Top 10 - 2013 (Previous Version) | ⇒ | OWASP Top 10 - 2017 (Current Version) |
---|---|---|
A1-Injection | ⇒ | A1:2017-Injection |
A2-Broken Authentication and Session Management | ⇒ | A2:2017-Broken Authentication |
A3-Cross-Site Scripting (XSS) | ⇘ | A3:2017-Sensitive Data Exposure |
A4-Insecure Direct Object References - [Merged + A7] | ∪ | A4:2017-XML External Entities (XXE) [NEW] |
A5-Security Misconfiguration | ⇘ | A5:2017-Broken Access Control [Merged] |
A6-Sensitive Data Exposure | ⇗ | A6:2017-Security Misconfiguration |
A7-Missing Function Level Access Control - [Merged + A4] | ∪ | A7:2017-Cross-Site Scripting (XSS) |
A8-Cross-Site Request Forgery (CSRF) [Dropped] | ☒ | A8:2017-Insecure Deserialization [NEW, Community] |
A9-Using Components with Known Vulnerabilities | ⇒ | A9:2017-Using Components with Known Vulnerabilities |
A10-Unvalidated Redirects and Forwards [Dropped] | ☒ | A10:2017-Insufficient Logging&Monitoring [NEW, Community] |
![CC-by-sa-3 0-88x31.png](/images/6/64/CC-by-sa-3_0-88x31.png)