Add CWE-PoC list file #376
Conversation
This CSV file contains a list of CWEs which may result in a PoC value for "state of exploitation" because "the vulnerability has a well-known method of exploitation." It contains links to potential exploit tools. It also contains CWEs which could not be PoCs as well as some reasoning behind this.
koscinv
requested review from
sei-vsarvepalli and
ahouseholder
as code owners
There was a problem hiding this comment.
This looks good to me.
I expect there are places where folks could quibble with whether a tool is "easy enough" to use to exploit any instance of one of the CWEs listed. But I think this is a considered and well-formed place for us to have detailed conversations about that question if anyone would like to raise those questions in the details. In some sense, if anyone has questions about how to map data for State of Exploitation at that level of detail, I'll be quite pleased.
Thanks very much for putting this together!
There was a problem hiding this comment.
I moved this into a folder just for housekeeping. No changes to the csv from @koscinv
There was a problem hiding this comment.
In the interest of avoiding a follow-on issue to update the docs, I went ahead and added the CSV to the exploitation page and did a light revision to the page to make it fit in.
ahouseholder
added
documentation
This CSV file contains a list of CWEs which may result in a PoC value for "state of exploitation" because "the vulnerability has a well-known method of exploitation." It contains links to some exploit tools for those CWEs that indicate a potential PoC. It also contains CWEs which could not be PoCs as well as reasoning behind them. All CWEs in this list have been found to map to CVEs.
Potentially closes #158