Cyber Security Threat Summary:
MITRE recently published its list of the top 25 most dangerous software weaknesses for 2023. Every year, this list is calculated by analyzing public vulnerability data in the National Vulnerability Database for root cause mappings to CWE weaknesses for the previous two years. In total, 43,996 CVE entries were examined, with a score being assigned to each entry based on the prevalence and severity of the flaw. Among the top 25, the most prevalent and severe software weakness for 2023 relates to out-of-bounds write bugs, which typically can lead to the corruption of data, code execution, or even system crashes.

“Out-of-bounds Write also took the top spot in 2022. 70 vulnerabilities added to the Known Exploited Vulnerabilities (KEV) catalog in 2021 and 2022 were Out-of-bounds Write bugs” (The Hacker News, 2023).

Following in behind out-of-bounds write, other weaknesses within the top 25 include a case of SQL Injection, Use After Free, OS Command Injection, Improper Input Validation, Out-of-bounds Read, Path Traversal, Cross-Site Request Forgery (CSRF), and Unrestricted Upload of File with Dangerous Type.

Security Officer Comments:
According to CISA the successful exploitation of these vulnerabilities could enable a threat actor to take control over the affected system, steal data, or even prevent applications from working. Given the severity of the flaws, CISA is encouraging developers and product security response teams to review the CWE Top 25 list and evaluate recommended mitigations to determine those most suitable to adopt. The full list can be accessed down below:

https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html

In the upcoming weeks, the CWE program will also a series of further articles on the CWE Top 25 methodology, vulnerability mapping trends, and other useful information that help illustrate how vulnerability management plays an important role in Shifting the Balance of Cybersecurity Risk.

Link(s):
https://thehackernews.com/2023/06/mitre-unveils-top-25-most-dangerous.html