Lion Cipher Lab
Check CWE mappings in a findings list for gaps and inconsistency
- Penetration Testing / Red Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
CWE (Common Weakness Enumeration), maintained by MITRE, is the standard list of software and hardware weakness types. Each finding in a report usually carries a CWE ID, so that clients and tools can count weaknesses across tests, products and years. Those counts only mean something if mappings are precise and consistent. In practice, different testers map the same issue differently. One SQL injection gets CWE-89 and the next gets CWE-20, Improper Input Validation, a broad class that says almost nothing. An IDOR becomes CWE-284, Improper Access Control, which MITRE discourages for mapping.…
What you'll learn
- what CWE is and why findings carry CWE IDs
- MITRE's vulnerability mapping usage: ALLOWED and DISCOURAGED
- mapping to the most specific Base or Variant weakness
- detecting inconsistent mappings across testers
- how bad mappings distort aggregate reporting
- what an automated mapping check cannot verify
- building a team mapping reference
Steps in this lab
- What a CWE mapping is for
- The findings list
- Write the checker
- Run it and fix the mappings
- Measure what the checker cannot see