evalle (Partner) asked a question.
CWE mapping to OWASP Mobile
How can we know which OWASP Mobile Category belongs to each CWE reported in the flaws module?
There's a table of Policy Compliance where we can see the number of vulnerabilities in each category of the OWASP Mobile, and we kno there is the "https://help.veracode.com/r/CWEs_That_Violate_the_OWASP_2017_Standard" - CWEs That Violate the OWASP Mobile Standard - , but how can we know in wich category of OWASP Mobile it's each CWE?
Regards.
.png){kind=logo}
Hi @evalle (Partner) ,
You can find our Categories at https://help.veracode.com/r/c_review_cwe .
You can find out what category a given CWE is by referencing this page.
To make this a bit easier I've transformed that list to JSON here: https://gist.github.com/relaxnow/c26afafbc6293cdc6373946b305ad4f3#file-categories-json
And transformed the "CWEs That Violate the OWASP Mobile Standard" list (from https://help.veracode.com/r/CWEs_That_Violate_the_OWASP_Mobile_Standard ) too here:
https://gist.github.com/relaxnow/c26afafbc6293cdc6373946b305ad4f3#file-cwes-mobile-json
Then I created a simple Go script that matches CWEs from the mobile standard to categories:
https://gist.github.com/relaxnow/c26afafbc6293cdc6373946b305ad4f3#file-main-go
And outputted this as an Excel compatible semicolon CSV: https://gist.github.com/relaxnow/c26afafbc6293cdc6373946b305ad4f3#file-new-cwes-mobile-csv
And it's own JSON file:
https://gist.github.com/relaxnow/c26afafbc6293cdc6373946b305ad4f3#file-new-cwes-mobile-json
Does that help?
Thank you,
Boy Baukema
Thanks for the information and the effort for the mapping, it's very useful, but from here two questions.
1.- In the results of Policy Control we can see the "fails" we have for OWASP Top 10 Mobile, but how can we identify which flaws are or which one CWEs are?
2.- If we look for OWASP Top 10 categories we find this:
M1: Improper Platform Usage
M2: Insecure Data Storage
M3: Insecure Communication
M4: Insecure Authentication
M5: Insufficient Cryptography
M6: Insecure Authorization
M7: Client Code Quality
M8: Code Tampering
M9: Reverse Engineering
M10: Extraneous Functionality
In the information you mapped, how could we identify which CWE belongs to each one of this OWASP Top 10 mobile categories?
Thanks a lot for the information.
Ah, that's a good point, unfortunately I don't believe we currently publish our link between Standard Sections and individual CWEs.
Please consider registering an idea with Veracode Community Ideas to augment our documentation with this at https://community.veracode.com/s/ideas .
For now I'd recommend using the Triage Flaws view with "Fix for policy" set to "Required" to find all flaws that violate the policy that has been set for the application.
Thank you,
Boy Baukema
Sounds good, thanks for the time to answer my questions.
Regards.