CWE-610

Class Abstraction Level
Pillar — Highest-level weakness category
Class — Abstract, language-independent
Base — Specific enough to detect
Variant — Tied to specific technology
Compound — Requires multiple weaknesses Draft MITRE CWE Status
Stable — Fully reviewed and complete
Draft — Under development, may change
Incomplete — Partially defined by MITRE
Deprecated — No longer recommended
Obsolete — Replaced by another CWE
Externally Controlled Reference to a Resource in Another Sphere

Description

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Top Monitored CVEs

CVE-2022-27593
CRITICAL KEV
9.1 87.9%
2022-09-08
CVE-2024-10979
HIGH
8.8 4.4%
2024-11-14
CVE-2022-2431
HIGH
8.8 2.7%
2022-09-06
CVE-2025-0111
MEDIUM KEV
6.5 1.9%
2025-02-12
CVE-2024-47773
HIGH
8.2 1.6%
2024-10-08
CVE-2024-24760
HIGH
7.3 0.9%
2024-02-02

Consequences

Confidentiality, Integrity — Read Application Data, Modify Application Data

An adversary could read or modify data, depending on how the resource is intended to be used.

Access Control — Gain Privileges or Assume Identity

An adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms.