I was reading articles about OWASP A2 (2017) and the found below comparison chart. One thing I noticed was that "Broken Account and Session Management" has changed place over the years:
- In 2003 and 2004 it was A3.
- In 2007 it was A7.
- In 2010 it was A3.
- In 2013 and 2017 it is A2.
What is the reason for this?
(Original source from which the image was generated is unknown. Google reverse image search https://images.app.goo.gl/haEq2nxGjKYzgWrR9 shows that a more complete image that includes footnotes is at https://goldcrock.wordpress.com/2015/02/ - but it's unclear where that was originally sourced.)