CWE Glossary Definition |
👁 x
|
CWE-710: Improper Adherence to Coding Standards
|
Weakness ID: 710
Vulnerability Mapping:
DISCOURAGED
This CWE ID should not be used to map to real-world vulnerabilities
Abstraction:
Pillar
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
|
The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
👁 Section Help
This table specifies different individual consequences
associated with the weakness. The Scope identifies the application security area that is
violated, while the Impact describes the negative technical impact that arises if an
adversary succeeds in exploiting this weakness. The Likelihood provides information about
how likely the specific consequence is expected to be seen relative to the other
consequences in the list. For example, there may be high likelihood that a weakness will be
exploited to achieve a certain impact, but a low likelihood that it will be exploited to
achieve a different impact.
| Impact |
Details |
|
Other
|
Scope: Other
|
👁 +
Potential Mitigations
| Phase(s) |
Mitigation |
|
Policy
|
Select and require coding
standards. Ensure that they include security
concerns.
|
|
Implementation
|
Closely follow coding standards, possibly
enforcing them upon checkin of the code into a source
control system or with periodic analyses.
|
👁 Section Help
This table shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition,
relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user
may want to explore.
👁 +
Relevant to the view "Research Concepts" (View-1000)
| Nature |
Type |
ID |
Name |
| MemberOf |
👁 View
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries).
|
1000
|
Research Concepts
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
476
|
NULL Pointer Dereference
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
477
|
Use of Obsolete Function
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
484
|
Omitted Break Statement in Switch
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
489
|
Active Debug Code
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
570
|
Expression is Always False
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
571
|
Expression is Always True
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
573
|
Improper Following of Specification by Caller
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
657
|
Violation of Secure Design Principles
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
684
|
Incorrect Provision of Specified Functionality
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
758
|
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1041
|
Use of Redundant Code
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1044
|
Architecture with Number of Horizontal Layers Outside of Expected Range
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1048
|
Invokable Control Element with Large Number of Outward Calls
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1059
|
Insufficient Technical Documentation
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1061
|
Insufficient Encapsulation
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1065
|
Runtime Resource Management Control Element in a Component Built to Run on Application Servers
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1066
|
Missing Serialization Control Element
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1068
|
Inconsistency Between Implementation and Documented Design
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1076
|
Insufficient Adherence to Expected Conventions
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1092
|
Use of Same Invokable Control Element in Multiple Architectural Layers
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1093
|
Excessively Complex Data Representation
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1101
|
Reliance on Runtime Component in Generated Code
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1120
|
Excessive Code Complexity
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1126
|
Declaration of Variable with Unnecessarily Wide Scope
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1127
|
Compilation with Insufficient Warnings or Errors
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1164
|
Irrelevant Code
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1177
|
Use of Prohibited Code
|
| ParentOf |
👁 Base
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1209
|
Failure to Disable Reserved Bits
|
| ParentOf |
👁 Class
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
|
1357
|
Reliance on Insufficiently Trustworthy Component
|
👁 +
Modes
Of Introduction
👁 Section Help
The different Modes of Introduction provide information
about how and when this
weakness may be introduced. The Phase identifies a point in the life cycle at which
introduction
may occur, while the Note provides a typical scenario related to introduction during the
given
phase.
| Phase |
Note |
| Architecture and Design |
| Implementation |
👁 +
Weakness Ordinalities
| Ordinality |
Description |
|
Primary
|
(where the weakness exists independent of other weaknesses)
|
|
Indirect
|
(where the weakness is a quality issue that might indirectly make it easier to introduce security-relevant weaknesses or make them more difficult to detect)
|
| Method |
Details |
|
Automated Static Analysis
|
Automated tools can detect violations of many code standards.
|
👁 Section Help
This MemberOf Relationships table shows additional CWE Categories and Views that
reference this weakness as a member. This information is often useful in understanding where a
weakness fits within the context of external information sources.
| Nature |
Type |
ID |
Name |
| MemberOf |
👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
978
|
SFP Secondary Cluster: Implementation
|
| MemberOf |
👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1370
|
ICS Supply Chain: Common Mode Frailties
|
| MemberOf |
👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1375
|
ICS Engineering (Construction/Deployment): Gaps in Details/Data
|
| MemberOf |
👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1383
|
ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements
|
| MemberOf |
👁 Category
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1412
|
Comprehensive Categorization: Poor Coding Practices
|
👁 +
Vulnerability Mapping Notes
|
Usage
|
DISCOURAGED
(this CWE ID should not be used to map to real-world vulnerabilities)
|
| Reason |
Abstraction
|
|
Rationale
|
This CWE entry is extremely high-level, a Pillar.
|
|
Comments
|
Consider children or descendants of this entry instead.
|
👁 +
Submissions |
| Submission Date |
Submitter |
Organization |
2008-09-09
(CWE 1.0, 2008-09-09)
|
CWE Content Team |
MITRE |
👁 +
Modifications |
| Modification Date |
Modifier |
Organization |
2025-12-11
(CWE 4.19, 2025-12-11)
|
CWE Content Team |
MITRE |
|
updated Detection_Factors, Potential_Mitigations, Weakness_Ordinalities
|
2024-02-29
(CWE 4.14, 2024-02-29)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2023-06-29
(CWE 4.12, 2023-06-29)
|
CWE Content Team |
MITRE |
|
updated Mapping_Notes
|
2023-04-27
(CWE 4.11, 2023-04-27)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2023-01-31
(CWE 4.10, 2023-01-31)
|
CWE Content Team |
MITRE |
|
updated Description
|
2022-04-28
(CWE 4.7, 2022-04-28)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2020-02-24
(CWE 4.0, 2020-02-24)
|
CWE Content Team |
MITRE |
|
updated Applicable_Platforms, Relationships, Type
|
2019-01-03
(CWE 3.2, 2019-01-03)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2017-11-08
(CWE 3.0, 2017-11-08)
|
CWE Content Team |
MITRE |
|
updated Applicable_Platforms, Name, Relationships
|
2017-01-19
(CWE 2.10, 2017-01-19)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2014-07-30
(CWE 2.8, 2014-07-31)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2013-02-21
(CWE 2.4, 2013-02-21)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2012-10-30
(CWE 2.3, 2012-10-30)
|
CWE Content Team |
MITRE |
|
updated Potential_Mitigations
|
2012-05-11
(CWE 2.2, 2012-05-15)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
2011-06-01
(CWE 1.13, 2011-06-01)
|
CWE Content Team |
MITRE |
|
updated Common_Consequences
|
2009-03-10
(CWE 1.3, 2009-03-10)
|
CWE Content Team |
MITRE |
|
updated Relationships
|
👁 +
Previous Entry Names |
| Change Date |
Previous Entry Name |
| 2017-11-08
|
Coding Standards Violation |
More information is available — Please edit the custom filter or select a different filter.
|
