CodeWallDocs
Reference

Vulnerability Classification

How CodeWall classifies and scores vulnerabilities using CVSS and CWE.

CodeWall uses industry-standard frameworks to classify and score every finding.

CVSS — Common Vulnerability Scoring System

Every validated finding receives a CVSS v3.1 score that reflects its severity.

Score ranges

ScoreSeverityDescription
9.0 – 10.0CriticalFull system compromise, trivial to exploit
7.0 – 8.9HighSignificant impact, relatively easy exploitation
4.0 – 6.9MediumModerate impact or requires specific conditions
0.1 – 3.9LowLimited impact, difficult to exploit
0.0InformationalNot directly exploitable

Scoring factors

CVSS scores account for:

  • Attack Vector — network, adjacent, local, or physical
  • Attack Complexity — low or high
  • Privileges Required — none, low, or high
  • User Interaction — none or required
  • Scope — changed or unchanged
  • Impact — confidentiality, integrity, and availability

CWE — Common Weakness Enumeration

Every finding is mapped to one or more CWE identifiers. CWE provides a standardized taxonomy of software weaknesses.

Common CWEs in CodeWall findings

CWENameCategory
CWE-79Cross-site Scripting (XSS)Injection
CWE-89SQL InjectionInjection
CWE-78OS Command InjectionInjection
CWE-287Improper AuthenticationAuthentication
CWE-862Missing AuthorizationAccess Control
CWE-639Authorization Bypass (IDOR)Access Control
CWE-918Server-Side Request ForgeryServer-Side
CWE-22Path TraversalServer-Side
CWE-502Deserialization of Untrusted DataServer-Side
CWE-352Cross-Site Request ForgeryClient-Side
CWE-601Open RedirectConfiguration
CWE-16ConfigurationConfiguration

OWASP mapping

Findings also map to the OWASP Top 10 (2021) categories:

  1. A01 — Broken Access Control (CWE-639, CWE-862)
  2. A02 — Cryptographic Failures (CWE-327, CWE-328)
  3. A03 — Injection (CWE-79, CWE-89, CWE-78)
  4. A04 — Insecure Design (CWE-502)
  5. A05 — Security Misconfiguration (CWE-16)
  6. A06 — Vulnerable Components (known CVEs)
  7. A07 — Authentication Failures (CWE-287)
  8. A08 — Data Integrity Failures (CWE-502)
  9. A09 — Logging Failures (CWE-778)
  10. A10 — SSRF (CWE-918)

Scope Configuration

Syntax and rules for defining what CodeWall can and cannot test.

Artifacts

Outputs and deliverables produced by a CodeWall penetration test.

On this page

CVSS — Common Vulnerability Scoring SystemScore rangesScoring factorsCWE — Common Weakness EnumerationCommon CWEs in CodeWall findingsOWASP mapping