A02:2025 Security Misconfiguration

OWASP Top 10:2025 · Back to the list

Defaults are weak, hardening is incomplete, cloud / framework / server settings leave attack surface exposed.

Member CWEs (16)

CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption
CWE-11 ASP.NET Misconfiguration: Creating Debug Binary
CWE-13 ASP.NET Misconfiguration: Password in Configuration File
CWE-15 External Control of System or Configuration Setting
CWE-16
CWE-260 Password in Configuration File
CWE-315 Cleartext Storage of Sensitive Information in a Cookie
CWE-489 Active Debug Code
CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable
CWE-547 Use of Hard-coded, Security-relevant Constants
CWE-611 Improper Restriction of XML External Entity Reference
CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
CWE-1174 ASP.NET Misconfiguration: Improper Model Validation

Mapped NIST 800-53 r5 controls (47)

Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Tagged CVEs (showing 50 most recent of 2,264)

Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1437).