Security Misconfiguration
Medium · Configuration
OWASP Top 10:2025 (current)
A02:2025 — Security Misconfiguration
Historical Top 10:2021 (not current)
A05:2021 — kept for older reports; use 2025 above.
CWE
CWE-16
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A02:2025 · OWASP A05:2021 · CWE-16
Definition
Insecure defaults, verbose errors, open storage.
Root cause
Missing hardening and review.
Affected components
- Cloud storage
- Default credentials
- Verbose errors
- Open admin panels
Impact
Information disclosure to full compromise.
Severity
Medium
Safe lab reproduction
Prowler on your own sandbox cloud account
Detection methodology
Config scanners, CSPM, CIS benchmarks.
Evidence examples
- Public bucket listing in sandbox
Remediation
Hardening baselines, automated config checks.
Secure coding examples
Infrastructure as code with policy checks.
Related CYNARKS lessons & labs
Tools: prowler · nuclei · lynis
Primary 2025 class: A02:2025 — Security Misconfiguration
Practise related skills in Labs or deepen on Academy library.