owasp-category-mapping

name	OWASP Category Mapping
description	Use this skill when the user asks for OWASP Top 10 mapping, CWE alignment, or standards-oriented reporting. The directory name stays `owasp-2025` for backward compatibility, but external reports should use official OWASP Top 10 names.
version	2.0.0

OWASP Top 10 Reference

Purpose

Map VulnScout findings to official OWASP Top 10 category names, highlight what the plugin covers well, and keep reports aligned with widely recognized security terminology.

Reporting Rule

• Use official OWASP Top 10 names in user-facing reports.
• Treat the owasp-2025 directory name as a compatibility alias, not as proof of a future OWASP taxonomy.
• Prefer CWE plus concrete vulnerability class when a finding does not fit cleanly into a single OWASP bucket.

Coverage Overview

OWASP Top 10	VulnScout Coverage	Primary Skills
A01: Broken Access Control	Strong	business-logic, threat-modeling
A02: Cryptographic Failures	Strong	cryptographic-failures
A03: Injection	Strong	vuln-patterns, dangerous-functions, framework-patterns
A04: Insecure Design	Strong	business-logic, threat-modeling
A05: Security Misconfiguration	Strong	security-misconfiguration, framework-patterns
A06: Vulnerable and Outdated Components	Out of scope	(dependency and SBOM tooling)
A07: Identification and Authentication Failures	Moderate	vuln-patterns, business-logic
A08: Software and Data Integrity Failures	Moderate	vuln-patterns, sensitive-data-leakage
A09: Security Logging and Monitoring Failures	Strong	logging-failures, sensitive-data-leakage
A10: Server-Side Request Forgery	Strong	vuln-patterns, framework-patterns, vulnerability-chains

Mapping Guidance

A01: Broken Access Control

Use for:

• IDOR
• missing authorization checks
• role and tenant boundary bypasses
• unsafe direct access to user-controlled object identifiers

Common CWE anchors:

• CWE-284
• CWE-285
• CWE-639
• CWE-862
• CWE-863

A02: Cryptographic Failures

Use for:

• weak or obsolete algorithms
• hardcoded secrets
• insecure randomness
• missing encryption on sensitive data paths

Common CWE anchors:

• CWE-326
• CWE-327
• CWE-330
• CWE-338
• CWE-798

A03: Injection

Use for:

• SQL injection
• command injection
• SSTI
• XSS
• LDAP injection
• unsafe interpreter invocation

Common CWE anchors:

• CWE-77
• CWE-78
• CWE-79
• CWE-89
• CWE-90
• CWE-94

A04: Insecure Design

Use for:

• missing rate limits or workflow controls
• trust boundary violations
• dangerous state transitions
• business logic flaws that are not just a missing authorization check

Common CWE anchors:

• CWE-209
• CWE-256
• CWE-501
• CWE-522
• CWE-656

A05: Security Misconfiguration

Use for:

• debug mode in production
• insecure defaults
• exposed internal tooling
• missing hardening headers or framework safety controls

Common CWE anchors:

• CWE-16
• CWE-209
• CWE-215
• CWE-548
• CWE-756

A06: Vulnerable and Outdated Components

Out of scope for this plugin's code-review workflow. If the user needs this category:

• hand off to dependency scanning, SBOM, or supply-chain tooling
• do not overstate coverage in VulnScout-generated reports

A07: Identification and Authentication Failures

Use for:

• session fixation
• weak password or token validation
• authentication bypass
• unsafe MFA or reset flows

Common CWE anchors:

• CWE-287
• CWE-288
• CWE-294
• CWE-307
• CWE-384
• CWE-640

A08: Software and Data Integrity Failures

Use for:

• unsafe deserialization
• integrity bypasses in update or build flows
• unsigned or unverified data loading
• missing signature verification

Common CWE anchors:

• CWE-345
• CWE-353
• CWE-502
• CWE-565
• CWE-784
• CWE-829

A09: Security Logging and Monitoring Failures

Use for:

• log injection
• secrets in logs
• missing security event coverage
• missing or unusable audit trails for critical actions

Common CWE anchors:

• CWE-117
• CWE-223
• CWE-532
• CWE-778

A10: Server-Side Request Forgery

Use for:

• server-side fetches of attacker-controlled URLs
• metadata service reachability
• internal pivoting through HTTP clients
• webhook, callback, and proxy misuse without host or protocol controls

Common CWE anchors:

• CWE-918

Reporting Template

When mapping a finding, prefer this shape:

- OWASP: A03 Injection
- CWE: CWE-89
- Why it fits: user-controlled input reaches SQL execution without parameter binding

Guardrails

• Do not upgrade a hotspot into a reportable finding just to fill an OWASP bucket.
• If the best label is uncertain, keep the concrete vulnerability type and CWE, and state the OWASP category as provisional.
• Unsupported-language verification should remain na_cpg, not false_positive.