OWASP Top 10 Web Application Security Risks
Explore the OWASP Top 10 Web Application Security Risks and learn how to protect your web applications.
OWASP Top 10 Vulnerability Index Table
The OWASP Top 10 is based on a consensus of security experts from around the world. The risks are ranked by exploitability, detectability, and impact. Organizations should use this list to understand the most critical web application security risks and take appropriate measures to protect their applications.
| Rank | Vulnerability | Description | Impact |
|---|---|---|---|
| 1 | Broken Access Control | Restrictions on what authenticated users are allowed to do are often not properly enforced. | Critical |
| 2 | Cryptographic Failures | Failures related to cryptography which often lead to exposure of sensitive data. | Critical |
| 3 | Injection | User-supplied data is not validated, filtered, or sanitized by the application. | Critical |
| 4 | Insecure Design New | Flaws in design and architecture that cannot be fixed by proper implementation. | High |
| 5 | Security Misconfiguration | Improperly configured permissions on cloud services, unnecessary features enabled. | High |
| 6 | Vulnerable Components | Using components with known vulnerabilities undermines application defenses. | High |
| 7 | Auth Failures | Confirmation of the user's identity, authentication, and session management. | High |
| 8 | Software and Data Integrity Failures New | Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations. | High |
| 9 | Logging Failures | Insufficient logging and monitoring coupled with missing or ineffective integration with incident response. | High |
| 10 | SSRF New | Server-Side Request Forgery flaws occur when a web application is fetching a remote resource without validating the user-supplied URL. | High |
Top 3 Critical Focus Areas
A01: Broken Access Control
Restrictions on authenticated users are not enforced. Attackers can access unauthorized functionality or view sensitive files.
- Bypassing access control checks
- CWE-200: Exposure of Sensitive Information
- CWE-201: Insertion of Sensitive Info into Sent Data
A02: Cryptographic Failures
Previously known as Sensitive Data Exposure. Focuses on failures related to cryptography leading to sensitive data leaks.
- CWE-259: Hard-coded Password
- CWE-327: Broken Crypto Algorithm
- CWE-331: Insufficient Entropy
A03: Injection
User-supplied data is not validated or sanitized, executing arbitrary commands or queries on target systems.
- SQL Injection (SQLi)
- Cross-Site Scripting (XSS)
- Local File Inclusion (LFI)
Complete OWASP Web Top 10 Breakdown
A04:2021Insecure Design
Flaws in design and architecture that cannot be fixed by proper implementation alone. Requires threat modeling, secure design patterns, and reference architectures.
A05:2021Security Misconfiguration
Improperly configured permissions on cloud services, default accounts/passwords, enabled unnecessary features, or verbose error handling leaking stack traces.
A06:2021Vulnerable and Outdated Components
Using third-party libraries, frameworks, or dependencies with known vulnerabilities (CVEs) undermines application defenses.
A07:2021Identification and Authentication Failures
Weaknesses in confirmation of user identity, session management, or missing multi-factor authentication (MFA).
A08:2021Software and Data Integrity Failures
Flaws related to code updates, sensitive data, and CI/CD pipelines without verifying integrity (e.g. untrusted auto-updates, supply chain attacks).
A09:2021Security Logging and Monitoring Failures
Insufficient logging, auditing, and monitoring allowing attackers to maintain long-term persistence without detection.
A10:2021Server-Side Request Forgery (SSRF)
Occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to access internal services.