I am writing a paper on "The Role of Architecture and Design in Software Assurance" and a commenter asked "Provide a stronger case for using the CWE over the CVE. Explain how CVE vulnerabilities relate to the design phase and static code analysis." As the article is more for software engineers and developers, I am looking for an accurate, clear, and concise explanation that speaks to that audience.


2 Answers 2


Briefly: CVEs are for "known knowns" or specific vulnerabilities. CWEs are for "unknown knowns" or vulnerability types. Dynamic scanners are looking for instances of already-identified vulnerabilities. Static scanners do that, too, but one of their main advantages is that they are also looking for not-yet-identified new vulnerabilities.

An obvious example is that if you are testing code that the world has never encountered before, how could there already be a registered CVE about it? You can, however, talk about the type of problem, and that is what a CWE does.


As part of building the CVE, MITRE developed in 2005 a preliminary classification and categorization of vulnerabilities, attacks, faults, and other concepts to generalize the CVE into common software weaknesses. However, while sufficient for CVE, those groupings were too rough to be used to identify and categorize the functionality offered by the code security assessment tool makers. The CWE List was created to better address those additional needs. CVE are akin to an inventory of traffic accidents while the CWE are analogous to the conditions (e.g. highway architecture, bridge and road design, traffic signage, driver practices, enforcement procedures) that lead to accidents. Given the large number of CVE and the process for reporting them, CVE references to architectural and design causes are intermittent and largely unverified. When generating findings from code scans, static code analysis tools can draw upon the CWE for weakness descriptions and mitigation recommendations; identifying the relevant CVE would be difficult given their specificity and their disconnection from the code that generated them.

  • 2
    This is not a discussion forum. Answers should not be used to ask questions. You might like to refer to the help center and faq for more information about how this site works.
    – D.W.
    Jul 23, 2014 at 23:34
  • On the Ask a Question page security.stackexchange.com/questions/ask there is the option "Answer your own question – share your knowledge, Q&A-style"
    – WaltHouser
    Jul 29, 2014 at 18:09
  • Yes, you are permitted to answer your own questions -- but please limit yourself to an answer. "What are your thoughts?" is inappropriate -- this is not a discussion forum, and you should not use the answer box to ask a question or solicit discussion. I've edited your answer accordingly. When answering your own question, it is particularly important to make sure you have done a reasonable amount of research before asking the question, and only ask if the answer is not apparent from standard resources.
    – D.W.
    Jul 29, 2014 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .