In short
A CVE is a symptom; a CWE is the diagnosis. Fixing the CVE closes one door; understanding the CWE closes the whole row of identical doors your code would open next year. That is the difference between repairing and preventing.
· 6 min read.
CWE vs. CVE: the difference in one example
Take CVE-2021-44228, Log4Shell. Its CWE is CWE-917: expression language injection. The two levels call for two different fixes.
Fixing the CVE means upgrading Log4j to version 2.17. It is urgent, it is done in an evening, and it protects you from that one flaw only.
Fixing the CWE means preventing any incoming data from ever reaching an expression evaluator. It takes time and calls for a design review — and it also protects you from the next three flaws of the same family, including those that do not have a number yet.
A single CWE covers thousands of CVEs. That is why a security report that only talks about CVEs describes a snapshot, never a trend.
The weaknesses you will run into most
A handful of CWEs account for a huge share of published CVEs. For each one, a well-known example makes the idea concrete:
| CWE | Weakness | What the attacker gets | Well-known case |
|---|---|---|---|
CWE-79 | Cross-site scripting (XSS) | Run code in another user's browser | Countless CMS and plugin flaws |
CWE-89 | SQL injection | Read or modify the database | CVE-2023-34362 (MOVEit) |
CWE-787 | Out-of-bounds write | Corrupt memory, often all the way to code execution | Browser and network stack flaws |
CWE-22 | Path traversal | Read files outside the intended directory | Edge device and VPN flaws |
CWE-352 | Cross-site request forgery (CSRF) | Make a logged-in user act without knowing it | Poorly protected admin interfaces |
CWE-862 | Missing authorization | Reach a function without being allowed to | Very common API flaws |
CWE-416 | Use after free | Hijack program execution | Rendering engine flaws |
CWE-78 | OS command injection | Run commands on the server | Appliance and router flaws |
CWE-917 | Expression language injection | Run code through an interpreted string | CVE-2021-44228 (Log4Shell) |
The full list has more than 900 entries, organized as a hierarchy: from very general pillars down to very specific variants. It is available at cwe.mitre.org; we do not duplicate its 900 rows here, as they would teach you nothing the official catalog does not.
The CWE Top 25: what it is really for
Every year, MITRE publishes the CWE Top 25 most dangerous weaknesses, ranked by combining the frequency of associated CVEs with their severity. In the 2024 edition, CWE-79 (XSS) is back at the top, ahead of CWE-787 (out-of-bounds write) and CWE-89 (SQL injection).
This ranking is not for deciding what to fix this week: it is for deciding what to train a team on and what to tune static analysis tools for. It is a prevention tool, not an alert triage tool — the two are often confused, and that wastes time at both ends.
The CAPEC, CWE, CVE chain
Three catalogs, three questions: an attack pattern (CAPEC) describes how it is done, a weakness (CWE) describes the flaw being exploited, a vulnerability (CVE) describes where that flaw actually lives.
Applied to Log4Shell: code injection (CAPEC-242) → expression language injection (CWE-917) → Log4j 2.0 to 2.14.1 (CVE-2021-44228). Reading in this direction lets you anticipate; reading the other way lets you react.
What it means for you, in practice
Three uses that fit in a team meeting:
- Count your CVEs by CWE over the last twelve months. If
CWE-862shows up eight times, you do not have eight bugs: you have an access control design problem. - Tune your analysis tools to the three most frequent CWEs in your code rather than the 900 default rules. The false positive rate collapses, and the team stops ignoring the reports.
- Put the CWE in the ticket, not just the CVE. The developer fixing it then understands what not to write again elsewhere.
Key takeaways
- A CWE is the root cause; a CVE is how it shows up in a product.
- A handful of CWEs (XSS, SQL injection, out-of-bounds write) account for most CVEs.
- The CWE Top 25 is for training and tuning your tools, not for triaging alerts.
- CAPEC describes the attack, CWE the flaw, CVE where the flaw lives.
FAQ
How many CWEs are there?
More than 900, organized as a hierarchy (pillars, classes, bases, variants). Only about a hundred come up regularly in published CVEs: those are the ones to focus on.
CWE or CVE to drive application security?
CWE for prevention, because it describes a class of flaws you can eliminate at design time. CVE for response, because it identifies a specific flaw to fix in a specific product. Both, never one instead of the other.
Can a CVE have several CWEs?
Yes, and it is common. An exploit chain often combines an authorization weakness with an injection. The records then list several CWEs; the first one listed is usually the most direct cause.