Mapping note of the week Weekly

One weakness a week where the popular chained mapping loses the thread. Updated 2026-07-25.

Every week I pick one weakness and follow the popular way of connecting it to attacker behavior: chain it through an intermediate catalog, weakness to attack pattern (CAPEC) to technique (ATT&CK). The chain looks authoritative and it quietly loses common weaknesses along the way. We map weakness to technique directly, so the connection does not vanish.

This week: CWE-79, Cross-site scripting (XSS)

Following the public chain from CWE-79	Result
Attack patterns (CAPEC) that reference this weakness	6
ATT&CK techniques the chain reaches through them	0

Computed live from the CAPEC catalog. The chain breaks because only 177 of 559 attack-pattern entries carry any ATT&CK technique mapping at all, so most weaknesses terminate at an attack pattern that goes nowhere. A tool built on this chain reports no attacker techniques for cross-site scripting (xss), which is a mapping failure, not a fact about the weakness.

When a tool says a weakness maps to no attacker techniques, check whether it derived that through a chain. Absence in a chained mapping usually means the chain broke. We map these directly for exactly this reason.