3

I was reading articles about OWASP A2 (2017) and the found below comparison chart. One thing I noticed was that "Broken Account and Session Management" has changed place over the years:

  • In 2003 and 2004 it was A3.
  • In 2007 it was A7.
  • In 2010 it was A3.
  • In 2013 and 2017 it is A2.

What is the reason for this?

Comparison of OWASP rankings over the years.

(Original source from which the image was generated is unknown. Google reverse image search https://images.app.goo.gl/haEq2nxGjKYzgWrR9 shows that a more complete image that includes footnotes is at https://goldcrock.wordpress.com/2015/02/ - but it's unclear where that was originally sourced.)

Improve this question

1 Answer 1

Reset to default
2

My understanding is that they are rated on the prevalence of that specific risk in the wild.

This is explained in the introduction to OWASP top 10 here

Welcome to the OWASP Top 10...reorders some of the others based on changing prevalence data.

So A1 is more common in the wild than A2 and so on.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.