CWE-1092, Use of Same Invokable Control Element in Multiple Architectural Layers, applies when a product uses the same control element, such as a function or method, across multiple architectural layers.
MITRE marks it as a quality issue with no direct security implications, and prohibits it for mapping real vulnerabilities.
How it happens
A layered design separates presentation, business logic and data access. Then one helper, say a validation routine or a formatting function, gets called from all three because it was convenient. The layers now depend on a shared piece of code that belongs to none of them.
# Smell: one function serves the UI, the service and the database layer
def clean_name(value):
return value.strip().title()
Reuse is not wrong in itself. The problem shows up when that shared function needs a change for one layer and breaks another.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability, with an indirect effect on how hard vulnerabilities are to find and fix. A shared element that does validation is the sensitive case: loosen it for one layer, and you may weaken the check everywhere else.
How to find it
Dependency analysis tools and architecture tests show which modules call which. Look for utilities imported from every layer.
How to fix it
- Decide which layer owns each responsibility, and call across layers only through defined interfaces.
- Keep truly generic helpers in a small, well tested shared library.
- Validate at each trust boundary rather than trusting an earlier layer.
Quick check
Is sharing code across layers always wrong?
No. Generic utilities are fine. The concern is shared logic that carries layer specific rules, because one change can affect every layer.
