OWASP Top 10-2017 - The Ten Most Critical Web Application Security Risks

Oct 13, 2026

OWASP Top 10-2017 identifies the ten most critical web application security risks and explains why insecure software threatens financial, healthcare, defense, energy, and other essential infrastructure. It emphasizes the need to discover and resolve common risks quickly as software becomes more complex and connected. The foreword highlights extensive community feedback, concise testable issue recommendations, and guidance for developers, security testers, organizations, and application managers, referencing ASVS and next-step resources.

LanguageEnglish

CategoryGeneral

FormatPDF

Pages25

Reading Time9 min

AccessFree to download

About OWASP

FW Foreword

Table of Contents

Introduction

Release Notes

OWASP Top 10 Application Security Risks – 2017

A1:2017 Injection

A2:2017 Broken Authentication

A3:2017 Sensitive Data Exposure

A4:2017 XML External Entities (XXE)

A5:2017 Broken Access Control

A6:2017 Security Misconfiguration

A7:2017 Cross-Site Scripting (XSS)

A8:2017 Insecure Deserialization

A9:2017 Using Components with Known Vulnerabilities

A10:2017 Insufficient Logging & Monitoring

What’s Next for Developers

What’s Next for Security Testers

What’s Next for Organizations

What’s Next for Application Managers

Note About Risks

Details About Risk Factors

Methodology and Data

Acknowledgements

OWASP Top 10-2017 The Ten Most Critical Web Application Security Risks This work is licensed under a [https://owasp.org](https://owasp.org) Creative Commons Attribution-ShareAlike 4.0 International License 1 TOC Table of Contents | Table of Contents | | | About OWASP | | --- | --- | --- | --- | | TOC-About OWASP 1
FW-Foreword 2
I-Introduction 3
RN-Release Notes 4
Risk-Application Security Risks 5
T10-OWASP Top 10 Application Security
Risks – 2017 6
A1:2017-Injection …….………. .……………………… 7
A2:2017-Broken Authentication 8
A3:2017-Sensitive Data Exposure 9
A4:2017-XML External Entities (XXE) 10
A5:2017-Broken Access Control 11
A6:2017-Security Misconfiguration 12
A7:2017-Cross-Site Scripting (XSS) 13
A8:2017-Insecure Deserialization 14
A9:2017-Using Components with Known
Vulnerabilities 15
A10:2017-Insufficient Logging & Monitoring 16
+D-What’s Next for Developers 17
+T-What’s Next for Security Testers 18
+O-What’s Next for Organizations 19
+A-What’s Next for Application Managers 20
+R-Note About Risks 21
+RF-Details About Risk Factors 22
+DAT-Methodology and Data …. .…………………23
+ACK-Acknowledgements 24 | | | The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications and APIs that can be trusted.
At OWASP, you'll find free and open:
• Application security tools and standards.
• Complete books on application security testing, secure code development, and secure code review.
• Presentations and videos.
• Cheat sheets on many common topics.
• Standard security controls and libraries.
• Local chapters worldwide.
• Cutting edge research.
• Extensive conferences worldwide.
• Mailing lists.
Learn more at: [https://www.owasp.org](https://www.owasp.org).
All OWASP tools, documents, videos, presentations, and chapters are free and open to anyone interested in improving application security.
We advocate approaching application security as a people, process, and technology problem, because the most effective approaches to application security require improvements in these areas.
OWASP is a new kind of organization. Our freedom from commercial pressures allows us to provide unbiased, practical, and cost-effective information about application security.
OWASP is not affiliated with any technology company, although we support the informed use of commercial security technology. OWASP produces many types of materials in a collaborative, transparent, and open way.
The OWASP Foundation is the non-profit entity that ensures the project's long-term success. Almost everyone associated with OWASP is a volunteer, including the OWASP board, chapter leaders, project leaders, and project members. We support innovative security research with grants and infrastructure.
Come join us! | | Copyright and License | | | | | | Copyright © 2003 – 2017 The OWASP Foundation
This document is released under the Creative Commons Attribution Share-Alike 4.0 license.
For any reuse or distribution, you must make it clear to others the license terms of this work. | | | 2 FW Foreword | Foreword | | --- | | Insecure software is undermining our financial, healthcare, defense, energy, and other critical infrastructure. As our software becomes increasingly complex, and connected, the difficulty of achieving application security increases exponentially. The rapid pace of modern software development processes makes the most common risks essential to discover and resolve quickly and accurately. We can no longer afford to tolerate relatively simple security problems like those presented in this OWASP Top 10.
A great deal of feedback was received during the creation of the OWASP Top 10-2017, more than for any other equivalent OWASP effort. This shows how much passion the communit

FAQs

What is the purpose of OWASP Top 10-2017?

It raises awareness and provides a de facto application security standard by presenting the ten most critical web application security risks with concise, testable recommendations.

Why is application security harder today, according to the foreword?

Modern software is increasingly complex and connected, and rapid development processes increase the difficulty of achieving application security exponentially.

Who should use the “What’s Next” guidance in OWASP Top 10-2017?

The foreword provides different next steps for developers, security testers, organizations (suitable for CIOs and CISOs), and application managers responsible for the application lifecycle.

Oct 13, 2026

Upload by EvelynWrites