Weaknesses of type CWE-15

80 results

Controle Externo de Configurações do Sistema

A aplicação permite que um atacante modifique configurações críticas do sistema ou da aplicação através de entrada externa (parâmetros, arquivos, variáveis de ambiente, etc.), sem validação adequada. Isso pode levar ao comprometimento da segurança, funcionamento incorreto ou acesso não autorizado.

Example

Um serviço web aceita um parâmetro 'debug_mode' vindo da requisição HTTP e o usa diretamente para ligar/desligar logs sensíveis ou alternar validações de segurança. Um atacante manda debug_mode=true e expõe dados internos ou desativa proteções.

How to mitigate

Nunca confie em entradas externas para configurações sensíveis. Use apenas fontes confiáveis (arquivo de config protegido no servidor, variáveis de ambiente do deployment) e valide/sanitize rigorosamente qualquer entrada que possa impactar comportamento de segurança.

CVE-2024-39789CRITICALMultiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A spEPSS 1.1%CVE-2021-38453CRITICALAUVESY VersiondogEPSS 1.1%CVE-2021-27406HIGHPerFact OpenVPN-ClientEPSS 1.0%CVE-2024-4326CRITICALRemote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuiEPSS 1.0%CVE-2023-4704HIGHExternal Control of System or Configuration Setting in instantsoft/icms2EPSS 0.9%CVE-2026-22708HIGHCursor has a Terminal Tool Allowlist Bypass via Environment VariablesEPSS 0.8%CVE-2025-30512MEDIUMGrowatt Cloud portal External Control of System or Configuration SettingEPSS 0.6%CVE-2026-44417HIGHApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)EPSS 0.6%CVE-2024-21583MEDIUMVersions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gEPSS 0.6%CVE-2024-50358HIGHA CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKIEPSS 0.5%CVE-2022-41582HIGHThe security module has configuration defects.Successful exploitation of this vulnerability may affect system availability.EPSS 0.5%CVE-2026-35650HIGHOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationEPSS 0.5%CVE-2026-44774MEDIUMTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=falseEPSS 0.5%CVE-2025-27889LOWWing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injectionEPSS 0.4%CVE-2026-46485HIGHDash: Users can write to config despire permissions (OIDC tested)EPSS 0.4%CVE-2019-25716HIGHDräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network PacketEPSS 0.4%CVE-2026-22177MEDIUMOpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsEPSS 0.4%CVE-2026-27203HIGHeBay API MCP Server Affected by Environment Variable InjectionEPSS 0.4%CVE-2023-3321HIGHCode Execution through Writable Mosquitto Configuration FileEPSS 0.4%CVE-2026-30817MEDIUMArbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53EPSS 0.3%