OWASP Top10 2010 Released!
A couple of weeks ago, OWASP – Open Web Application Security Project published the new version of its most widely known project: OWASP TOP 10. This is the third edition of such project that deals with the 10 greatest vulnerabilities found in web applications.
Compared with 2007’s previous edition, the list of vulnerabilities has not changed that much, with code injection failures (ex: SQL Injection, command injection, etc.) and Cross-Site Scripting occupying the top of the list again. Please see the comparative table below:
|
OWASP Top 10 – 2007 |
OWASP Top 10 – 2010 (New) |
|
A2 – Injection Flaws |
A1 – Injection |
|
A1 – Cross Site Scripting (XSS) |
A2 – Cross-Site Scripting (XSS) |
|
A7 – Broken Authentication and Session Management |
A3 – Broken Authentication and Session Management |
|
A4 – Insecure Direct Object Reference |
A4 – Insecure Direct Object Reference |
|
A5 – Cross Site Request Forgery (CSRF) |
A5 – Cross-Site Request Forgery (CSRF) |
|
<was T10 2004 A10 – Insecure Configuration Management> |
A6 – Security Misconfiguration (New) |
|
A8 – Insecure Cryptographic Storage |
A7 – Insecure Cryptographic Storage |
|
A10 – Failure to Restrict URL Access |
A8 – Failure to Restrict URL Access |
|
A9 – Insecure Communications |
A9 – Insufficient Transport Layer Protection |
|
<not present on Top 10 2007> |
A10 – Unvalidated Redirects and Forwards (New) |
|
A3 – Malicious File Execution |
<Removed from Top 10 2010> |
|
A6 – Information Leakage and Improper Error Handling |
< Removed from Top 10 2010> |
OWASP is a non-profit organization created in 2003 with the mission to make application security visible so that individuals and organizations could be able to make well informed decisions about real application security risks. Bearing in mind that threats have become more evident in the application layer (and no longer in the network layer as it occurred 5 years ago) it is of the utmost importance that enterprises and corporations of all sizes using systems internally or externally developed get to know more about the potential risks present in Web applications.
The document in English, in its whole integrity, is made available HERE and soon its version in Portuguese will be also released, translated by both OWASP Brazil’s and OWASP Portugal’s communities.
N-Stalker’s solution is fully able to validate your environment against vulnerabilities listed on TOP 10 2010. Contact us!
