Skip to content

fix: correct CWE-201 official name in A01 mapped CWEs list#931

Open
NureddinSoltan wants to merge 1 commit intoOWASP:masterfrom
NureddinSoltan:fix/cwe-201-incorrect-name
Open

fix: correct CWE-201 official name in A01 mapped CWEs list#931
NureddinSoltan wants to merge 1 commit intoOWASP:masterfrom
NureddinSoltan:fix/cwe-201-incorrect-name

Conversation

@NureddinSoltan
Copy link
Copy Markdown

Related Issue:

Related to #930

What was wrong?

CWE-201 was listed under the List of Mapped CWEs in A01:2025 with an incorrect name:

"Exposure of Sensitive Information Through Sent Data"

What was changed?

Updated the CWE-201 name to match the official CWE dictionary:

"Insertion of Sensitive Information Into Sent Data"

Reference: https://cwe.mitre.org/data/definitions/201.html

* [CWE-200 Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html)

* [CWE-201 Exposure of Sensitive Information Through Sent Data](https://cwe.mitre.org/data/definitions/201.html)
* [CWE-201 Insertion of Sensitive Information Into Sent Data](https://cwe.mitre.org/data/definitions/201.html)
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the same in the 2021 Top 10 list:

[CWE-201 Exposure of Sensitive Information Through Sent Data](https://cwe.mitre.org/data/definitions/201.html)

As far as I can tell, the title of the CWE was this earlier, see the CWE 201 site back in 2020 July, and it was changed there and not followed up in the OWASP list.

Copy link
Copy Markdown
Author

@NureddinSoltan NureddinSoltan Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup, I’m aware of that. That’s why I updated it in 2025, not 2021.
Thank you, Judait. So I’ll keep it open specifically for 2025 docs
@JuditKnoll Should I update it also for 2021?

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found it strange, and just realized it, and thought, I'll share it. I'm not sure whether it should be updated in 2021, it depends on when it was modified. IMO the leaders of OWASP Top 10 should decide about this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants