CWE mapping

What it means

CWE mapping means attaching a Common Weakness Enumeration identifier to a finding. CWE is a community-maintained catalogue, run by MITRE, that gives each kind of software weakness a number and a name. For example, CWE-79 is cross-site scripting and CWE-89 is SQL injection.

A finding says what happened in your app. The CWE says what kind of mistake it was. That shared label lets people, tools and reports talk about the same thing without arguing over wording. Each entry also lists examples, common consequences and ways to prevent it, which makes it useful beyond naming.

Why it matters

Once findings carry a CWE, you can count them by type. If a third of your findings are missing-authorisation weaknesses, the fix is a design habit and not thirty separate patches. Trends across releases become visible, and training can aim at the real gaps.

Customers and auditors read these labels too. A report that maps to a standard catalogue is easier to compare, import into a tracker and check against a rule. It differs from a CVE, which names one specific flaw in one specific product.

How it shows up

You meet CWE identifiers in scanner and pentest reports, in vulnerability databases, and in lists such as the CWE Top 25. Check that each finding maps to the most specific entry that fits, not a broad parent such as a general input-validation entry.

Frequent mistakes are mapping to a vague parent, mapping to the symptom rather than the cause, and putting several weaknesses under one tag. Where a flaw has two causes, give two mappings. The CWE entry shows examples, consequences and typical fixes to link from the ticket.