1. Home
2. All questions
3. Question 76

CISSP study material · question 76 of 500

While mapping findings against the OWASP Top 10:2025, an application team looks for the XML External Entities category it tracked in earlier editions and finds the category gone. Its document parser still resolves external entity references by default. Where does the 2025 list account for this weakness?

• Software security
• Security assessment

1. Under Security Misconfiguration, which now absorbs external entity handling among its mapped weaknesses.
2. Under Mishandling of Exceptional Conditions, because the parser fails open when entity resolution errors.
3. Under Software Supply Chain Failures, because the defect lives in a third-party parser library.
4. Under Injection, alongside the SQL and command findings that share an untrusted-input pattern.

Challenge yourself on this topic → Study as cards