What is the difference between the terms "vulnerability" and "weakness" when it comes to security?

I was looking at the CWE page and it mentions that a weakness leads to a security vulnerability. I understand this only partially.

  1. From my understanding, this is the sequence flow starting from when a weakness is identified till it's exploited: (correct me if i'm wrong!)

    weakness -> vulnerability -> exploit -> security breach

    Is there something I'm missing/am I completely off?

  2. Can someone explain the difference between a weakness and a vulnerability with an example?

This is purely for better understanding the basic terminologies and different perceptions of the same. Many thank for everyone's help!


Your understanding is correct within the framework of the CWE1.

Typically when you encounter problems with terminology, it is best to focus on the scope where the term is used. The word weakness in itself has several meanings according to the Merriam-Webster dictionary, for instance:

1 : the quality or state of being weak; also : an instance or period of being weak
2 : fault, defect
3 a : a special desire or fondness
3 b : an object of special desire or fondness
pizza is my weakness

How the word weakness is used by the CWE is explained in their FAQ which you have linked. They even have a question in there which is more or less exactly phrased like yours "What is the difference between a software vulnerability and software weakness?"

There they state the following:

Software weaknesses are errors that can lead to software vulnerabilities. A software vulnerability, such as those enumerated on the Common Vulnerabilities and Exposures (CVE®) List, is a mistake in software that can be directly used by a hacker to gain access to a system or network.

So what kind of error can lead to a vulnerability and could therefore be called a weakness? Let's have a look at a randomly selected weakness from the CWE database.

CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

There are also examples given, let's look a short one:

Example 2

This code allocates a socket and forks each time it receives a new connection.

sock=socket(AF_INET, SOCK_STREAM, 0);
while (1) {
 newsock=accept(sock, ...);
 printf("A connection has been accepted\n");
 pid = fork();

The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely.

Now it gets interesting:
In itself this represents a working interface, but the consumption of resources is not controlled by the system. This is a weakness that leads to a vulnerability because it can be controlled by an attacker. If new connections can not be established by an attacker, this would still be a weakness, but it would not lead to a vulnerability.

To put it in other words:
All vulnerabilities rely on weaknesses, but not all weaknesses entail vulnerabilities.

1: For instance in the ISO 27000 framework the term weakness is not defined as a separate term. They only define vulnerability:

weakness of an asset or control that can be exploited by one or more threats

  • Thank you Tom. This makes sense. The problem is that while vulnerability is most commonly understood, weakness is used in a few forums. I think I get the basic gist. Vulnerabilities are a subset of weakness in a sense, correct? – Izy- Aug 27 '18 at 16:18
  • 1
    @Izy-: Yes, you could put it that way, but keep in mind, that this only is true for the framework of the CWE. – Tom K. Aug 28 '18 at 13:50

The first analogy coming to my mind is a dam, it can have weakness at some points of its structure. As long as this point is still hard enough to not break on extra pressure or covered to limit the impact there's no vulnerability for the dam integrity.

Obviously you'll probably want to fix the weakness to avoid it being a vulnerability from any bird/drone crashing on it.

While writing I saw Tom K's answer, which cover it in details, I hope the analogy helps getting an easier perspective :)

  • 1
    Thanks Tensibai! Can I please know why this was down voted? I thought the dam analogy was accurate in a way. – Izy- Aug 27 '18 at 16:17
  • Take the downvote as incomplete answer and not professional enough for this site (if it's not that, people can suggest improvements). I don't really care about the reputation points, if it helps someone to have an easier overview and the other answer for details, then I'm happy with it :) – Tensibai Aug 27 '18 at 21:00

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .