OWASP Top 10 2025
OWASP Top 10은 웹 애플리케이션 보안을 위한 표준 인식 문서입니다. 웹 애플리케이션에 가장 중요한 보안 위험에 대한 광범위한 합의를 나타냅니다.
Broken Access Control
Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of data. Now includes SSRF.
Security Misconfiguration
The application might be vulnerable if it is missing appropriate security hardening or has improperly configured permissions on cloud services.
Software Supply Chain Failures
Expanded from 'Vulnerable and Outdated Components' to address broader supply chain risks including unknown vulnerabilities introduced by third-parties, compromised packages, and build system attacks.
Cryptographic Failures
Failures related to cryptography which often lead to sensitive data exposure. This includes using weak algorithms, improper key management, and missing encryption.
Injection
Injection flaws occur when an application sends hostile data to an interpreter. This includes SQL, NoSQL, OS command, ORM, LDAP, and Expression Language injection.
Insecure Design
Insecure design is a broad category representing different weaknesses, expressed as missing or ineffective control design. This is distinct from implementation flaws.
Authentication Failures
Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.
Data Integrity Failures
Data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization and unsigned updates.
Security Logging and Alerting Failures
This category helps detect, escalate, and respond to active breaches. Without logging and alerting, breaches cannot be detected in time to respond.
Mishandling of Exceptional Conditions
A new category containing 24 CWEs focusing on improper error handling, logical errors, failing open, and other scenarios stemming from abnormal conditions that systems may encounter.
OWASP Top 10 취약점 스캔
Shoulder는 여러 OWASP 카테고리에 걸쳐 패턴을 감지합니다. 스캔을 실행하여 코드의 문제를 찾으세요.
npx @shoulderdev/cli trust .
위협 센터 →