This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Vulnerability template"
| (9 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
Every '''[[Vulnerability]]''' should follow this template. | Every '''[[Vulnerability]]''' should follow this template. | ||
| + | |||
| + | {{Template:Vulnerability}} | ||
| + | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' | ||
| + | |||
| + | [[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]] | ||
==Description== | ==Description== | ||
| − | A vulnerability is a weakness in an application (frequently a broken or missing | + | A vulnerability is a weakness in an application (frequently a broken or missing control) that enables an attack to succeed. Be sure you don't put [attacks] or [controls] in this category. |
# Start with a one-sentence description of the vulnerability | # Start with a one-sentence description of the vulnerability | ||
| Line 20: | Line 25: | ||
==Examples== | ==Examples== | ||
| − | + | ===Short example name=== | |
| − | : | + | : A short example description, small picture, or sample code with [http://www.site.com links] |
| − | + | ===Short example name=== | |
| − | : | + | : A short example description, small picture, or sample code with [http://www.site.com links] |
| Line 41: | Line 46: | ||
| − | ==Related [[ | + | ==Related [[Controls]]== |
| − | * [[ | + | * [[Control 1]] |
| − | * [[ | + | * [[Control 2]] |
| − | Note: contents of "Avoidance and Mitigation" Sections should be placed here | + | Note: contents of "Avoidance and Mitigation" and "Countermeasure" related Sections should be placed here |
| Line 56: | Line 61: | ||
==References== | ==References== | ||
| + | Note: A reference to related [http://cwe.mitre.org/ CWE] or [http://capec.mitre.org/ CAPEC] article should be added when exists. Eg: | ||
| + | |||
| + | * [http://cwe.mitre.org/data/definitions/79.html CWE 79]. | ||
| + | * http://www.link1.com | ||
| + | * [http://www.link2.com Title for the link2] | ||
| + | |||
| + | |||
| + | In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki> | ||
| + | |||
| + | Availability Vulnerability | ||
| + | |||
| + | Authorization Vulnerability | ||
| + | |||
| + | Authentication Vulnerability | ||
| + | |||
| + | Concurrency Vulnerability | ||
| + | |||
| + | Configuration Vulnerability | ||
| + | |||
| + | Cryptographic Vulnerability | ||
| + | |||
| + | Encoding Vulnerability | ||
| + | |||
| + | Error Handling Vulnerability | ||
| − | + | Input Validation Vulnerability | |
| − | |||
| + | Logging and Auditing Vulnerability | ||
| − | + | Session Management Vulnerability | |
| − | |||
| − | |||
__NOTOC__ | __NOTOC__ | ||
Latest revision as of 12:06, 5 September 2008
Every Vulnerability should follow this template.
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
Last revision (mm/dd/yy): 09/5/2008
Vulnerabilities Table of Contents
Description
A vulnerability is a weakness in an application (frequently a broken or missing control) that enables an attack to succeed. Be sure you don't put [attacks] or [controls] in this category.
- Start with a one-sentence description of the vulnerability
- What is the problem that creates the vulnerability?
- What are the attacks that target this vulnerability?
- What are the technical impacts of this vulnerability?
Risk Factors
- Talk about the factors that make this vulnerability likely or unlikely to actually happen
- Discuss the technical impact of a successful exploit of this vulnerability
- Consider the likely [business impacts] of a successful attack
Examples
Short example name
- A short example description, small picture, or sample code with links
Short example name
- A short example description, small picture, or sample code with links
Related Attacks
Related Vulnerabilities
Note: the contents of "Related Problems" sections should be placed here
Related Controls
Note: contents of "Avoidance and Mitigation" and "Countermeasure" related Sections should be placed here
Related Technical Impacts
References
Note: A reference to related CWE or CAPEC article should be added when exists. Eg:
In addition, one should classify vulnerability based on the following subcategories: Ex:[[Category:Error Handling Vulnerability]]
Availability Vulnerability
Authorization Vulnerability
Authentication Vulnerability
Concurrency Vulnerability
Configuration Vulnerability
Cryptographic Vulnerability
Encoding Vulnerability
Error Handling Vulnerability
Input Validation Vulnerability
Logging and Auditing Vulnerability
Session Management Vulnerability
