CWE

Common Weakness Enumeration

A community-developed list of SW & HW weaknesses that can become vulnerabilities
New to CWE? click here!
CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE- Individual Dictionary Definition (4.20)  
ID

CWE CATEGORY: 7PK - Environment

Category ID: 2
Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities
+ Summary
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
+ Membership
Nature Type ID Name
MemberOf ViewView - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). 700 Seven Pernicious Kingdoms
MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 933 OWASP Top Ten 2013 Category A5 - Security Misconfiguration
MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1349 OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 5 J2EE Misconfiguration: Data Transmission Without Encryption
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 6 J2EE Misconfiguration: Insufficient Session-ID Length
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 7 J2EE Misconfiguration: Missing Custom Error Page
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 8 J2EE Misconfiguration: Entity Bean Declared Remote
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 9 J2EE Misconfiguration: Weak Access Permissions for EJB Methods
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 11 ASP.NET Misconfiguration: Creating Debug Binary
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 12 ASP.NET Misconfiguration: Missing Custom Error Page
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 13 ASP.NET Misconfiguration: Password in Configuration File
HasMember VariantVariant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. 14 Compiler Removal of Code to Clear Buffers
+ Vulnerability Mapping Notes

Usage: PROHIBITED

(this CWE ID must not be used to map to real-world vulnerabilities)

Reason: Category

Rationale:

This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.

Comments:

See member weaknesses of this category.
+ References
[REF-6] Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools Techniques and Metrics. NIST. 2005-11-07. <https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf>.
+ Content History
+ Submissions
Submission Date Submitter Organization
2006-07-19
(CWE Draft 3, 2006-07-19) 		7 Pernicious Kingdoms
+ Modifications
Modification Date Modifier Organization
2023-06-29
(CWE 4.12, 2023-06-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-04-27
(CWE 4.11, 2023-04-27) 		CWE Content Team MITRE
updated Mapping_Notes
2021-10-28
(CWE 4.6, 2021-10-28) 		CWE Content Team MITRE
updated Relationships
2020-02-24
(CWE 4.0, 2020-02-24) 		CWE Content Team MITRE
updated References
2019-06-20
(CWE 3.3, 2019-06-20) 		CWE Content Team MITRE
updated Relationships
2018-03-27
(CWE 3.1, 2018-03-27) 		CWE Content Team MITRE
updated Relationships
2017-11-08
(CWE 3.0, 2017-11-08) 		CWE Content Team MITRE
updated Description, Maintenance_Notes, Name
2017-01-19
(CWE 2.10, 2017-01-19) 		CWE Content Team MITRE
updated Maintenance_Notes, Relationships
2015-12-07
(CWE 2.9, 2015-12-07) 		CWE Content Team MITRE
updated Relationships
2013-07-17
(CWE 2.5, 2013-07-17) 		CWE Content Team MITRE
updated Relationships
2008-09-08
(CWE 1.0, 2008-09-09) 		CWE Content Team MITRE
updated Relationships
+ Previous Entry Names
Change Date Previous Entry Name
2017-11-08 Environment
Page Last Updated: April 30, 2026
 

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.