Description
The product does not handle or incorrectly handles inputs that are related to complex structures.
Potential Impact
Integrity
Unexpected State
Demonstrative Examples
int processMessageFromSocket(int socket) {
int success;
char buffer[BUFFER_SIZE];char message[MESSAGE_SIZE];
// get message from socket and store into buffer
//Ignoring possibliity that buffer > BUFFER_SIZE
if (getMessage(socket, buffer, BUFFER_SIZE) > 0) {
// place contents of the buffer into message structure
ExMessage *msg = recastBuffer(buffer);
// copy message body into string for processing
int index;for (index = 0; index < msg->msgLength; index++) {message[index] = msg->msgBody[index];}message[index] = '\0';
// process message
success = processMessage(message);
}return success;
}Related Weaknesses
Taxonomy Mappings
- PLOVER: — Element Problems
Frequently Asked Questions
What is CWE-237?
CWE-237 (Improper Handling of Structural Elements) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not handle or incorrectly handles inputs that are related to complex structures.
How can CWE-237 be exploited?
Attackers can exploit CWE-237 (Improper Handling of Structural Elements) to unexpected state. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-237?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-237?
CWE-237 is classified as a Base-level weakness (Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.