名稱: Invokable Control Element with Large Number of Outward Calls

The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.

一般資訊

引入方式

Implementation
Architecture and Design

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

常見後果

範圍	影響	可能性
Other	Reduce Maintainability, Increase Analytical Complexity 注意：This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

偵測方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性 : High

漏洞對應備注

理由說明 : This entry is primarily a quality issue with no direct security implications.
備註 : Look for weaknesses that are focused specifically on insecure behaviors that have more direct security implications.

備注

While the interpretation of "excessively large Fan-Out value" may vary for each product or developer, CISQ recommends a default of 5 referenced objects. [REF-1133]

參考資料

REF-960

Automated Source Code Maintainability Measure (ASCMM)
Object Management Group (OMG).
https://www.omg.org/spec/ASCMM/

REF-1133

Automated Source Code Quality Measures
Consortium for Information & Software Quality (CISQ).
https://www.omg.org/spec/ASCQM/

REF-1534

Automated Technical Debt Measure, Version 2
OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF

提交

名稱	機構	日期	發布日期	Version
CWE Content Team	MITRE	2018-07-02 +00:00	2019-01-03 +00:00	3.2

修改記錄

名稱	機構	日期	備註
CWE Content Team	MITRE	2020-08-20 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Common_Consequences, Description, Time_of_Introduction
CWE Content Team	MITRE	2026-10-28 +00:00	updated Description, Detection_Factors, References, Terminology_Notes

CWE-1048 詳細資料

CWE-1048