.svg){kind=logo}
Overview
The Payment Card Industry Security Standards Council (PCI SSC) plays a crucial role in application security for organizations that handle payment card data.
The PCI SSC is responsible for developing and maintaining the Payment Card Industry Data Security Standard (PCI DSS). This standard is designed to ensure that companies accepting, processing, storing, or transmitting credit card information maintain a secure environment.
This article organizes Common Weakness Enumerations (CWEs) relevant to PCI DSS.
Each row in the table below outlines a specific compliance standard, categorized by the following columns:
-
Compliance Standard: The specific category of the standard to which the CWE is mapped.
-
CWE-ID: The relevant CWE for this standard.
PCI DSS 4.0 CWE Coverage
|
Compliance Standard |
CWE-ID |
|---|---|
|
6.2.4 |
|
|
6.2.4: Attack on data structure |
|
|
6.2.4: Attacks on access control mechanisms |
|
|
6.2.4: Buffer overflow - attack on data structure |
|
|
6.2.4: Business logic attacks |
|
|
6.2.4: Cryptography usage |
|
|
6.2.4: CSRF - business logic attacks |
|
|
6.2.4: Deserialization - attack on data structure |
|
|
6.2.4: Injection |
|
|
6.2.4: int overflow - attack on data structure |
|
|
6.2.4: int underflow - attack on data structure |
|
|
6.2.4: NULL dereference - attack on data structure |
|
|
6.2.4: OOB Read - attack on data structure |
|
|
6.2.4: OOB Write - attack on data structure |
|
|
6.2.4: SSRF |
|
|
6.2.4: Unsafe input validation - attack on data structure |
|
|
6.2.4: XSS - business logic attacks |
|
|
6.3.2 |
|
PCI DSS 3.2 CWE Coverage
|
Compliance Standard |
CWE-ID |
|---|---|
|
6.5.10: Broken Authentication and Session Management |
|
|
6.5.1: Injection Flaws |
|
|
6.5.2: Buffer Overflows |
|
|
6.5.3: Insecure Cryptographic Storage |
|
|
6.5.9: Cross-Site Request Forgery (CSRF) |
|
|
Cross-Site Scripting (XSS) |
|
|
Improper Access Control |
|