Mapping between CAPEC and ASVS 5.0
@Rohankaf is already working on this.
Since Nov 19, 2025.
- Dominant language
- Python
- Stars
- 180
- Forks
- 137
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 21
Description
I started to look at creating a mapping between CAPEC and ASVS 5.0, but then I realized that it is OpenCRE.
The challenge is that the current mapping is between CAPEC and ASVS 4.0.
Elar created a mapping between ASVS 4 and 5 https://asvs.dev/mapping_v4.0.3_to_v5.0.0.html
I went through it, requirement for requirement and it seems legit.
He has a yaml as well: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/mapping_v4.0.3_to_v5.0.0.yml
Could this make a migration possible perhaps?
There is an explanation for the expressions in the file as well: https://asvs.dev/Mappings/
There is a CWE mapping as well: https://github.com/OWASP/ASVS/blob/master/5.0/mappings/v5.0.be_cwe_mapping.json but it looks a bit strange at the end there. Not sure whether it is correct.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.