CWE Glossary Definition |
👁 x
|
CWE-1120: Excessive Code Complexity
|
Weakness ID: 1120
Vulnerability Mapping:
ALLOWED
This CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review
(with careful review of mapping notes)
Abstraction:
Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
The code is too complex, as calculated using a well-defined,
quantitative measure.
👁 Section Help
This table specifies different individual consequences
associated with the weakness. The Scope identifies the application security area that is
violated, while the Impact describes the negative technical impact that arises if an
adversary succeeds in exploiting this weakness. The Likelihood provides information about
how likely the specific consequence is expected to be seen relative to the other
consequences in the list. For example, there may be high likelihood that a weakness will be
exploited to achieve a certain impact, but a low likelihood that it will be exploited to
achieve a different impact.
| Impact |
Details |
|
Reduce Maintainability; Increase Analytical Complexity
|
Scope: Other
This issue makes it more difficult to understand and/or maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
|
|
Reduce Performance
|
Scope: Other
This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.
|
👁 Section Help
This table shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition,
relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user
may want to explore.
👁 +
Relevant to the view "Research Concepts" (View-1000)
| Nature |
Type |
ID |
Name |
| ChildOf |
👁 Pillar
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
|
710
|
Improper Adherence to Coding Standards
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1047
|
Modules with Circular Dependencies
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1056
|
Invokable Control Element with Variadic Parameters
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1060
|
Excessive Number of Inefficient Server-Side Data Accesses
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1064
|
Invokable Control Element with Signature Containing an Excessive Number of Parameters
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1075
|
Unconditional Control Flow Transfer outside of Switch Block
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1080
|
Source Code File with Excessive Number of Lines of Code
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1095
|
Loop Condition Value Update within the Loop
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1119
|
Excessive Use of Unconditional Branching
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1121
|
Excessive McCabe Cyclomatic Complexity
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1122
|
Excessive Halstead Complexity
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1123
|
Excessive Use of Self-Modifying Code
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1124
|
Excessively Deep Nesting
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1125
|
Excessive Attack Surface
|
👁 +
Modes
Of Introduction
👁 Section Help
The different Modes of Introduction provide information
about how and when this
weakness may be introduced. The Phase identifies a point in the life cycle at which
introduction
may occur, while the Note provides a typical scenario related to introduction during the
given
phase.
| Phase |
Note |
| Implementation |
👁 +
Weakness Ordinalities
| Ordinality |
Description |
|
Indirect
|
(where the weakness is a quality issue that might indirectly make it easier to introduce security-relevant weaknesses or make them more difficult to detect)
|
| Method |
Details |
|
Automated Static Analysis
|
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
|
👁 Section Help
This MemberOf Relationships table shows additional CWE Categories and Views that
reference this weakness as a member. This information is often useful in understanding where a
weakness fits within the context of external information sources.
| Nature |
Type |
ID |
Name |
| MemberOf |
👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1412
|
Comprehensive Categorization: Poor Coding Practices
|
👁 +
Vulnerability Mapping Notes
|
Usage
|
ALLOWED-WITH-REVIEW
(this CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review)
|
| Reason |
Abstraction
|
|
Rationale
|
This CWE entry is a Class and might have Base-level children that would be more appropriate
|
|
Comments
|
Examine children of this entry to see if there is a better fit
|
👁 +
Submissions |
| Submission Date |
Submitter |
Organization |
2018-07-02
(CWE 3.2, 2019-01-03)
|
CWE Content Team |
MITRE |
|
Entry derived from Common Quality Enumeration (CQE) Draft 0.9.
|
👁 +
Modifications |
| Modification Date |
Modifier |
Organization |
2025-12-11
(CWE 4.19, 2025-12-11)
|
CWE Content Team |
MITRE |
|
updated Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Time_of_Introduction
|
2023-06-29
(CWE 4.12, 2023-06-29)
|
CWE Content Team |
MITRE |
|
updated Mapping_Notes
|
2023-04-27
(CWE 4.11, 2023-04-27)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2023-01-31
(CWE 4.10, 2023-01-31)
|
CWE Content Team |
MITRE |
|
updated Description
|
2020-02-24
(CWE 4.0, 2020-02-24)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
More information is available — Please edit the custom filter or select a different filter.
|
