OWASP updates its Top 10 list of web application security risks every few years. This article shows the 2017 list and how it changed in the 2021 edition, which is the current one.

The OWASP Top 10 2017

1. A1:2017 Injection
2. A2:2017 Broken Authentication
3. A3:2017 Sensitive Data Exposure
4. A4:2017 XML External Entities (XXE)
5. A5:2017 Broken Access Control
6. A6:2017 Security Misconfiguration
7. A7:2017 Cross-Site Scripting (XSS)
8. A8:2017 Insecure Deserialization
9. A9:2017 Using Components with Known Vulnerabilities
10. A10:2017 Insufficient Logging & Monitoring

What changed in the OWASP Top 10 2021

OWASP published an updated list in 2021. The current categories are:

1. A01 Broken Access Control (moved up from 5th)
2. A02 Cryptographic Failures (previously Sensitive Data Exposure)
3. A03 Injection (now includes Cross-Site Scripting)
4. A04 Insecure Design (new)
5. A05 Security Misconfiguration (now includes XML External Entities)
6. A06 Vulnerable and Outdated Components
7. A07 Identification and Authentication Failures (previously Broken Authentication)
8. A08 Software and Data Integrity Failures (new, includes Insecure Deserialization)
9. A09 Security Logging and Monitoring Failures
10. A10 Server-Side Request Forgery (SSRF) (new)

How Vooki Pro helps

• Reports findings against the current OWASP Top 10 2021 categories.
• Includes checks for the new 2021 categories, such as SSRF and software and data integrity failures (insecure deserialization, Subresource Integrity).
• Generates an OWASP Top 10 compliance report you can share with auditors and customers.

Frequently asked questions

What is new in the OWASP Top 10 2021?

Three new categories: Insecure Design, Software and Data Integrity Failures, and Server-Side Request Forgery. Broken Access Control moved to number one.

Where did XSS go in the 2021 list?

Cross-Site Scripting was merged into A03 Injection.

Related: OWASP Top 10: the most critical web application security risks · Server-side request forgery (SSRF) and cloud metadata attacks