OWASP Top 10 2021 — šta je novo i zašto je važno

Šta je OWASP Top 10?

OWASP (Open Web Application Security Project) je neprofitna organizacija koja objavljuje listu deset najkritičnijih bezbednosnih rizika za web aplikacije. Lista nije rang popularnosti napada — ona odražava kombinaciju prevalencije, iskoristivosti i poslovnog uticaja svake klase ranjivosti. Koriste je developeri, sigurnosni timovi, auditori i kupci softvera širom sveta.

Verzija iz 2021. donela je značajne promene u odnosu na prethodno izdanje iz 2017: tri nove kategorije, dve koje su spojene i izmenjen redosled koji bolje odražava realne pretnje iz 2020-ih.

Pregled svih 10 kategorija

A01: Broken Access Control (novo: #1)

Kontrola pristupa je pala sa petog mesta na prvo. Razlog: u istraživanju je pronađena u čak 94% testiranih aplikacija. Ova kategorija pokriva situacije gde korisnici mogu da pristupe podacima ili funkcijama koje nisu namenjene njima — IDOR (Insecure Direct Object Reference), vertikalna eskalacija privilegija, pristup admin panelima bez autorizacije.

Shieldome Scout automatski testira više od 40 putanja na vašem sajtu koje napadači rutinski skeniraju: admin panele, konfiguracione fajlove, backup direktorijume i API endpoint-e koji bi trebalo da budu zaštićeni.

A02: Cryptographic Failures (novo: #2)

Ranije poznata kao "Sensitive Data Exposure", ova kategorija je preimenovana da bolje opiše koren problema: loša ili nedostajuća kriptografija. Uključuje prenos podataka bez HTTPS-a, slabu enkripciju u bazi podataka, izložene API ključeve i lozinke čuvane kao plain text.

A03: Injection (sa #1 na #3)

SQL Injection, XSS i Command Injection ostaju ozbiljni, ali su pali sa prvog mesta jer su moderne razvojne prakse (ORM, auto-escaping templating engine-i) smanjile prevalenciju. I dalje su jednako opasni kada se pojave.

A04: Insecure Design (NOVO)

Prva od tri potpuno nove kategorije. Odnosi se na arhitekturalne propuste nastale već u fazi dizajna — ne implementacione greške, nego pogrešno zamišljene bezbednosne pretpostavke. Primeri: API koji dozvoljava neograničen broj pokušaja logovanja, checkout flow koji ne validira cene na serveru.

A05: Security Misconfiguration (sa #6 na #5)

Default lozinke, otvoreni cloud storage, verbose error poruke, nepotrebni servisi u produkciji. Ova kategorija sada uključuje i XXE (XML External Entity) koji je ranije bio posebna stavka.

A06: Vulnerable and Outdated Components (sa #9 na #6)

Korišćenje JavaScript paketa, PHP biblioteka ili serverskog softvera sa poznatim ranjivostima. Jedan stari jQuery plugin može biti ulazna tačka za napadača.

A07: Identification and Authentication Failures (sa #2 na #7)

Pad sa drugog na sedmo mesto zahvaljujući standardizovanim bibliotekama za autentifikaciju. Ali i dalje: nedostatak MFA, slabe lozinke, broken session management ostaju česti problemi.

A08: Software and Data Integrity Failures (NOVO)

Druga nova kategorija. Pokriva situacije gde aplikacija ne proverava integritet softvera ili podataka koje učitava: nepotpisani npm paketi, CI/CD pipeline bez verifikacije, deserijalizacija nepouzdanih podataka, CDN resursi bez Subresource Integrity (SRI) atributa.

A09: Security Logging and Monitoring Failures (sa #10 na #9)

Bez adekvatnih logova, napad može proći nezapaženo danima ili nedeljama. Ova kategorija pokriva nedostatak logovanja kritičnih akcija, neadekvatne alarme i nepostojanje plana za odgovor na incidente.

A10: Server-Side Request Forgery (NOVO)

Treća nova kategorija, dodana direktno na osnovu ankete zajednice, bez statistike jer su SSRF napadi teški za automatsku detekciju. SSRF omogućava napadaču da natera server da šalje zahteve ka internim resursima — cloud metadata endpoint-ima, lokalnim servisima, internim API-jima.

Šta se promenilo od 2017.

Merged: "XML External Entities (XXE)" spojen u A05 Security Misconfiguration
Merged: "Cross-Site Scripting (XSS)" spojen u A03 Injection
Merged: "Insecure Deserialization" i "Using Components with Known Vulnerabilities" delimično presloženi
Novo: A04 Insecure Design, A08 Software/Data Integrity Failures, A10 SSRF

Kako da primenite OWASP Top 10 u praksi

Lista nije metodologija testiranja — ona je okvir za razumevanje rizika. Praktična primena znači redovne vulnerability assessmente koji pokrivaju sve ove kategorije, obuku development tima i prioritizaciju nalaza po CVSS score-u.

Shieldome Scout pokriva sve 10 OWASP kategorija u okviru standardne procene: od analize HTTP zaglavlja i SSL konfiguracije do detekcije izloženih admin putanja, reflektovanog XSS-a i SSRF indikatora — bez aktivne eksploatacije, pasivnom metodologijom koja ne narušava rad vašeg sajta.

Proverite bezbednost vašeg sajta

Profesionalna procena ranjivosti. OWASP Top 10, dark web monitoring, PDF izveštaj za 2–3 radna dana.

Zatražite procenu →

← Blog

What Is OWASP Top 10?

OWASP (Open Web Application Security Project) is a non-profit organization that publishes a list of the ten most critical security risks for web applications. The list is not a popularity ranking of attacks — it reflects a combination of prevalence, exploitability, and business impact for each class of vulnerability. It is used by developers, security teams, auditors, and software buyers worldwide.

The 2021 edition brought significant changes compared to the previous 2017 release: three new categories, two merged categories, and a revised order that better reflects real threats of the 2020s.

All 10 Categories Explained

A01: Broken Access Control (new: #1)

Access control jumped from fifth place to first. The reason: it was found in 94% of tested applications. This category covers situations where users can access data or functions not intended for them — IDOR (Insecure Direct Object Reference), vertical privilege escalation, access to admin panels without proper authorization.

Shieldome Scout automatically tests over 40 paths on your site that attackers routinely scan: admin panels, configuration files, backup directories, and API endpoints that should be protected.

A02: Cryptographic Failures (new: #2)

Previously known as "Sensitive Data Exposure," this category was renamed to better describe the root cause: poor or missing cryptography. This includes data transmission without HTTPS, weak encryption in databases, exposed API keys, and passwords stored as plain text.

A03: Injection (from #1 to #3)

SQL Injection, XSS, and Command Injection remain serious but dropped from first place because modern development practices (ORMs, auto-escaping templating engines) have reduced prevalence. They are still just as dangerous when they appear.

A04: Insecure Design (NEW)

The first of three completely new categories. It refers to architectural flaws that emerge during the design phase — not implementation bugs, but incorrectly conceived security assumptions. Examples: an API that allows unlimited login attempts, a checkout flow that doesn't validate prices server-side.

A05: Security Misconfiguration (from #6 to #5)

Default passwords, open cloud storage, verbose error messages, unnecessary services in production. This category now includes XXE (XML External Entity) which was previously a separate item.

A06: Vulnerable and Outdated Components (from #9 to #6)

Using JavaScript packages, PHP libraries, or server software with known vulnerabilities. A single outdated jQuery plugin can be an attacker's entry point.

A07: Identification and Authentication Failures (from #2 to #7)

The drop from second to seventh place is thanks to standardized authentication libraries. But still: lack of MFA, weak passwords, and broken session management remain common problems.

A08: Software and Data Integrity Failures (NEW)

The second new category. It covers situations where an application doesn't verify the integrity of software or data it loads: unsigned npm packages, CI/CD pipelines without verification, deserialization of untrusted data, CDN resources without Subresource Integrity (SRI) attributes.

A09: Security Logging and Monitoring Failures (from #10 to #9)

Without adequate logs, an attack can go unnoticed for days or weeks. This category covers the lack of logging for critical actions, inadequate alerts, and no incident response plan.

A10: Server-Side Request Forgery (NEW)

The third new category, added directly based on community survey without statistics because SSRF attacks are difficult to automatically detect. SSRF allows an attacker to trick a server into sending requests to internal resources — cloud metadata endpoints, local services, internal APIs.

What Changed Since 2017

Merged: "XML External Entities (XXE)" merged into A05 Security Misconfiguration
Merged: "Cross-Site Scripting (XSS)" merged into A03 Injection
New: A04 Insecure Design, A08 Software/Data Integrity Failures, A10 SSRF

How to Apply OWASP Top 10 in Practice

The list is not a testing methodology — it is a framework for understanding risk. Practical application means regular vulnerability assessments covering all these categories, development team training, and prioritization of findings by CVSS score.

Shieldome Scout covers all 10 OWASP categories in a standard assessment: from HTTP header analysis and SSL configuration to detection of exposed admin paths, reflected XSS, and SSRF indicators — without active exploitation, using passive methodology that does not disrupt your site's operation.

Check Your Website Security

Professional vulnerability assessment. OWASP Top 10, dark web monitoring, PDF report in 2–3 business days.

Request Assessment →