1968
Nature Type ID Name Page
ChildOf 710 Improper Adherence to Coding Standards 1549
ParentOf 107 Struts: Unused Validation Form 259
ParentOf 110 Struts: Validator Without Form Field 264
ParentOf 561 Dead Code 1275
ParentOf 563 Assignment to Variable without Use 1280
ParentOf 1071 Empty Code Block 1910
Weakness Ordinalities
Indirect :
Common Consequences
Scope Impact Likelihood
Other Reduce Reliability
Other Reduce Performance
Demonstrative Examples
Example 1:
The condition for the second if statement is impossible to satisfy. It requires that the variables be
non-null. However, on the only path where s can be assigned a non-null value, there is a return
statement.
Example Language: C++ (Bad)
String s = null;
if (b) {
s = "Yes";
return;
}
if (s != null) {
Dead();
}
Example 2:
The following code excerpt assigns to the variable r and then overwrites the value without using it.
Example Language: C (Bad)
r = getName();
r = getNewBuffer(buf);
Observed Examples
Reference Description
CVE-2014-1266 chain: incorrect "goto" in Apple SSL product bypasses certificate validation,
allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug).
CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) ->
CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong
Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
https://www.cve.org/CVERecord?id=CVE-2014-1266
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-1173: Improper Use of Validation Framework
CWE-1173: Improper Use of Validation Framework