引入方式
Implementation
适用平台
编程语言
类： Not Language-Specific (Undetermined)
常见后果
| 影响范围 |
影响 |
可能性 |
| Other | Reduce Reliability | |
| Other | Reduce Performance | |
观察示例
| 参考资料 |
描述 |
| Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability. |
检测方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
漏洞映射说明
依据 : This CWE entry is a Class and might have Base-level children that would be more appropriate
备注 : Examine children of this entry to see if there is a better fit
提交记录
| 名称 |
组织 |
日期 |
发布日期 |
Version |
| CWE Content Team |
MITRE |
2019-01-02 +00:00 |
2019-01-03 +00:00 |
3.2 |
修改记录
| 名称 |
组织 |
日期 |
备注 |
| CWE Content Team |
MITRE |
2020-02-24 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2022-04-28 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2023-01-31 +00:00 |
updated Description |
| CWE Content Team |
MITRE |
2023-04-27 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2023-06-29 +00:00 |
updated Mapping_Notes |
| CWE Content Team |
MITRE |
2023-10-26 +00:00 |
updated Observed_Examples |
| CWE Content Team |
MITRE |
2024-02-29 +00:00 |
updated Demonstrative_Examples |
| CWE Content Team |
MITRE |
2025-12-11 +00:00 |
updated Applicable_Platforms, Detection_Factors, Observed_Examples, Time_of_Introduction, Weakness_Ordinalities |
| CWE Content Team |
MITRE |
2026-10-28 +00:00 |
updated Description, Relationships, Technical_Nuance |
