Anbieter und Produkte

CPE, kurz für Common Platform Enumeration, ist ein standardisiertes Schema zur Benennung von Hardware, Software und Betriebssystemen. CPE bietet ein strukturiertes Benennungsschema zur eindeutigen Identifizierung und Klassifizierung von IT-Systemen, Plattformen und Paketen basierend auf Attributen wie Anbieter, Produktname, Version, Update, Edition und Sprache.

Name: Inappropriate Whitespace Style

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Allgemeine Informationen

Einführungsmodi

Implementation

Anwendbare Plattformen

Sprache

Klasse: Not Language-Specific (Undetermined)

Häufige Konsequenzen

Bereich	Auswirkung	Wahrscheinlichkeit
Other	Increase Analytical Complexity Hinweis: A human auditor might indirectly trust that whitespace (especially indentation) reflects the actual control flow of the code, which could make it more difficult to find vulnerabilities.
Other	Reduce Maintainability Hinweis: This issue makes it more difficult to understand and maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities.

Beobachtete Beispiele

Referenzen	Beschreibung
CVE-2014-1266	Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Erkennungsmethoden

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Wirksamkeit : High

Hinweise zur Schwachstellen-Zuordnung

Begründung : This entry is primarily a quality issue with no direct security implications.
Kommentar : Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

Referenzen

REF-963

Providing a Framework for Effective Software Quality Assessment
Robert A. Martin, Lawrence H. Shafer.
https://www.researchgate.net/publication/285403022_PROVIDING_A_FRAMEWORK_FOR_EFFECTIVE_SOFTWARE_QUALITY_MEASUREMENT_MAKING_A_SCIENCE_OF_RISK_ASSESSMENT

Einreichung

Name	Organisation	Datum	Veröffentlichungsdatum	Version
CWE Content Team	MITRE	2018-07-02 +00:00	2019-01-03 +00:00	3.2

Änderungen

Name	Organisation	Datum	Kommentar
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Time_of_Introduction
CWE Content Team	MITRE	2026-10-28 +00:00	updated Detection_Factors

Die auf CVE Find präsentierten Informationen stammen aus mehreren sorgfältig ausgewählten Referenzquellen. CVE-Daten werden von der MITRE Corporation und der National Vulnerability Database (NVD) bereitgestellt. Der Katalog bekannter ausgenutzter Schwachstellen (KEV) stammt von der Cybersecurity and Infrastructure Security Agency (CISA), während EPSS-Scores von FIRST.org kommen. Darüber hinaus werden Daten zu Software-Schwachstellen (CWE) und häufigen Angriffsmustern (CAPEC) von der MITRE Corporation gepflegt, und Informationen zu Hardware- und Software-Konfigurationen (CPE) werden von der NVD bereitgestellt.

CWE-1114 Details

CWE-1114