v1

latestOpenAPI 3.0.3MIT2026-07-1792846.7 KB
CWE

CWE weaknesses

This API endpoint returns a given set of CWE weaknesses by identifier. Multiple identifiers are separated by a comma. If the keyword "all" is given, all CWE weaknesses are returned.

get/cwe/weakness/{id(s)}

Path parameters

id(s)string required

CWE Weakness ID(s) - comma separated

Response

success

Example response

{
  "Weaknesses": [
    {
      "ID": "79",
      "Name": "Weakness Title",
      "Abstraction": "Base",
      "Structure": "Simple",
      "Status": "Stable",
      "Description": "A short description of the weakness",
      "ExtendedDescription": "A long description of the weakness",
      "LikelihoodOfExploit": "High",
      "RelatedWeaknesses": [
        {
          "Nature": "ChildOf",
          "CweID": "74",
          "ViewID": "1000",
          "Ordinal": "Primary"
        },
        {
          "Nature": "PeerOf",
          "CweID": "352",
          "ViewID": "1000"
        }
      ],
      "WeaknessOrdinalities": [
        {
          "Ordinality": "Resultant",
          "Description": "A short description of ordinality"
        }
      ],
      "ApplicablePlatforms": [
        {
          "Type": "Language",
          "Name": "Javascript",
          "Class": "Language-Independent",
          "Prevalence": "Often"
        }
      ],
      "BackgroundDetails": [
        "A short detail text",
        "Another detail"
      ],
      "AlternateTerms": [
        {
          "Term": "Another name for the weakness",
          "Description": "A description of the term"
        }
      ],
      "ModesOfIntroduction": [
        {
          "Phase": "Architecture and Design",
          "Note": "A brief note on the phase"
        }
      ],
      "CommonConsequences": [
        {
          "Scope": [
            "Integrity",
            "Confidentiality"
          ],
          "Impact": [
            "Read Application Data",
            "Modify Application Data"
          ],
          "Likelihood": [
            "High"
          ],
          "Note": "A brief note on the consequence"
        }
      ],
      "DetectionMethods": [
        {
          "DetectionMethodID": "DM-1",
          "Method": "Automated Static Analysis",
          "Description": "A brief description of the detection",
          "Effectiveness": "Moderate",
          "EffectivenessNotes": "A brief note on the detection effectiveness"
        }
      ],
      "PotentialMitigations": [
        {
          "MitigationID": "MIT-5",
          "Phase": [
            "Architecture and Design",
            "Implementation"
          ],
          "Strategy": "Parameterization",
          "Description": "A brief description on the mitigation",
          "Effectiveness": "High",
          "EffectivenessNotes": "A brief example on the effectiveness of the mitigation"
        }
      ],
      "DemonstrativeExamples": [
        {
          "ID": "DX-60",
          "Entries": [
            {
              "IntroText": "Short text at begining of example"
            },
            {
              "Nature": "bad",
              "Language": "PHP",
              "ExampleCode": "A markdown representation of the code"
            },
            {
              "BodyText": "Example text"
            },
            {
              "Nature": "good",
              "ExampleCode": "A markdown representation of the code"
            },
            {
              "BodyText": "Example text"
            },
            {
              "Reference": "REF-1990"
            }
          ]
        }
      ],
      "ObservedExamples": [
        {
          "Reference": "CVE-2021-1879",
          "Description": "A short description of the example",
          "Link": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-1879"
        }
      ],
      "FunctionalAreas": [
        "Cryptography",
        "Logging",
        "String Processing"
      ],
      "AffectedResources": [
        "System Process",
        "File or Directory"
      ],
      "TaxonomyMappings": [
        {
          "TaxonomyName": "OWASP Top Ten",
          "EntryID": "A1",
          "EntryName": "Cross Site Scription (XSS)",
          "MappingFit": "Exact"
        }
      ],
      "RelatedAttackPatterns": [
        "103",
        "23"
      ],
      "References": [
        {
          "ExternalReferenceID": "REF-2",
          "Section": "Chapter 11, Page 384",
          "Authors": [
            "John Doe",
            "Jane Doe"
          ],
          "Title": "An Analysis of All That is Wrong With Software Development",
          "Edition": "2nd Edition",
          "PublicationYear": "2000",
          "PublicationMonth": "01",
          "PublicationDay": "01",
          "Publisher": "Perfect Publishing",
          "URL": "https://example.com",
          "URLDate": "2021-10-24"
        }
      ],
      "MappingNotes": {
        "Usage": "allowed",
        "Rationale": "A brief explanation on mapping rationale",
        "Comments": "Comments on the mapping",
        "Reasons": [
          "Acceptable-Use",
          "Other"
        ]
      },
      "Notes": [
        {
          "Type": "Relationship",
          "Note": "A note on the relationship"
        }
      ],
      "ContentHistory": [
        {
          "Type": "Submission",
          "SubmissionName": "PLOVER",
          "SubmissionDate": "2006-07-19"
        },
        {
          "Type": "Modification",
          "ModificationName": "John Doe",
          "ModificationOrganization": "ACME Corp",
          "ModificationDate": "2008-07-01",
          "ModificationComment": "Updated Description"
        },
        {
          "Type": "Rename",
          "PreviousEntryName": "Old name",
          "Date": "2000-01-04"
        }
      ]
    }
  ]
}