Vulnerability classification
XBOW detects vulnerabilities and groups them using the Common Weakness Enumerations (CWEs) that NIST selects for the National Vulnerability Database. From that set, XBOW uses the classes that describe attacks on web applications.
How to read the CWE list
XBOW has a full-time research team working on the detection of new vulnerability classes. When the precision of a new class is high enough, XBOW makes it available to customers, initially as a private preview but moving toward general availability as the analysis matures.
The release phase for a CWE reflects XBOW’s confidence in the precision of the results. Each phase requires higher precision than the one before.
Finding type
- Vulnerability: An exploitable weakness in your asset.
- Informational: A potential issue or a non-standard configuration, rather than an immediately exploitable vulnerability. These findings suggest a departure from best practices.
Validation
- Deterministic: XBOW confirms findings for this class with a non-AI exploit validator. All findings are verified as true vulnerabilities, so the class reports no false positives.
- AI agent: XBOW uses agents rather than a deterministic validator to confirm findings for this class, so some false positives are possible.
- Not applicable: XBOW does not exploit informational findings, so there is nothing to validate.
Release phase
New vulnerability classes are made available only when they reach a reasonable level of precision.
- Generally available (GA): XBOW reports this class on every comprehensive assessment. There is nothing to enable. Internal testing shows over 90% true positive results.
- Public preview: XBOW reports this class only if you enable the attack type. Precision is still maturing. Internal testing shows over 70% true positive results. See Configure the attack types to run.
- Private preview: XBOW reports this class only if you ask XBOW to enable it. Precision is under development. To keep false positive results to a minimum, XBOW’s internal security team triages all findings before they are included in your results. This means that findings from private preview classes appear after the end of your assessment.
CWE list
| CWE ID | CWE name | Finding type | Validation | Release phase |
|---|---|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | Vulnerability | Deterministic | GA |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | Vulnerability | Deterministic | GA |
| CWE-77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) | Vulnerability | Deterministic | GA |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | Vulnerability | Deterministic | GA |
| CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’, XSS) | Vulnerability | Deterministic | GA |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | Vulnerability | Deterministic | GA |
| CWE-94 | Improper Control of Generation of Code (‘Code Injection’) | Vulnerability | Deterministic | GA |
| CWE-116 | Improper Encoding or Escaping of Output (‘HTTP Request/Response Splitting’) | Informational | Not applicable | GA |
| CWE-204 | Observable Response Discrepancy (‘User Enumeration’) | Vulnerability | AI agent | GA |
| CWE-287 | Improper Authentication | Informational | Not applicable | GA |
| CWE-306 | Missing Authentication for Critical Function | Informational | Not applicable | GA |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Informational | Not applicable | GA |
| CWE-384 | Session Fixation | Informational | Not applicable | GA |
| CWE-425 | Direct Request (‘Forced Browsing’) | Informational | Not applicable | GA |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Vulnerability | Deterministic | GA |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) | Vulnerability | Deterministic | GA |
| CWE-502 | Deserialization of Untrusted Data | Vulnerability | Deterministic | GA |
| CWE-552 | Files or Directories Accessible to External Parties | Informational | Not applicable | GA |
| CWE-601 | URL Redirection to Untrusted Site (‘Open Redirect’) | Vulnerability | Deterministic | GA |
| CWE-611 | Improper Restriction of XML External Entity Reference (‘XXE’) | Vulnerability | Deterministic | GA |
| CWE-639 | Authorization Bypass Through User-Controlled Key (‘IDOR’) | Vulnerability | AI agent | Public preview |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Informational | Not applicable | GA |
| CWE-862 | Missing Authorization | Vulnerability | Deterministic | GA |
| CWE-863 | Incorrect Authorization | Vulnerability | AI agent | Public preview |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement (‘Expression Language Injection’) | Vulnerability | Deterministic | GA |
| CWE-918 | Server-Side Request Forgery (SSRF) | Vulnerability | Deterministic | GA |
| CWE-1021 | Clickjacking | Informational | Not applicable | GA |