Weaknesses of type CWE-15

94 results

Controle Externo de Configurações do Sistema

A aplicação permite que um atacante modifique configurações críticas do sistema ou da aplicação através de entrada externa (parâmetros, arquivos, variáveis de ambiente, etc.), sem validação adequada. Isso pode levar ao comprometimento da segurança, funcionamento incorreto ou acesso não autorizado.

Example

Um serviço web aceita um parâmetro 'debug_mode' vindo da requisição HTTP e o usa diretamente para ligar/desligar logs sensíveis ou alternar validações de segurança. Um atacante manda debug_mode=true e expõe dados internos ou desativa proteções.

How to mitigate

Nunca confie em entradas externas para configurações sensíveis. Use apenas fontes confiáveis (arquivo de config protegido no servidor, variáveis de ambiente do deployment) e valide/sanitize rigorosamente qualquer entrada que possa impactar comportamento de segurança.

CVE-2024-39794CRITICALMultiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. EPSS 1.1%CVE-2023-32349HIGH Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter paEPSS 1.1%CVE-2021-38453CRITICALAUVESY VersiondogEPSS 1.1%CVE-2024-4326CRITICALRemote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuiEPSS 1.0%CVE-2025-41452MEDIUMPost auth nginx configuration injection in Danfoss AK-SM8xxA SeriesEPSS 0.9%CVE-2023-4704HIGHExternal Control of System or Configuration Setting in instantsoft/icms2EPSS 0.9%CVE-2026-22708HIGHCursor has a Terminal Tool Allowlist Bypass via Environment VariablesEPSS 0.8%CVE-2026-44417HIGHApache CXF: Incomplete fix for CVE-2025-48913 (Untrusted JMS configuration can lead to RCE)EPSS 0.7%CVE-2025-30512MEDIUMGrowatt Cloud portal External Control of System or Configuration SettingEPSS 0.7%CVE-2026-13745HIGHArbitrary Code Execution in Gemini CLI via Untrusted Local .env Files Overriding GEMINI_CLI_HOMEEPSS 0.7%CVE-2024-21583MEDIUMVersions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gEPSS 0.6%CVE-2022-41582HIGHThe security module has configuration defects.Successful exploitation of this vulnerability may affect system availability.EPSS 0.6%CVE-2026-87987CRITICALAn arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable EPSS 0.6%CVE-2026-96218MEDIUMWindows Update Stack Tampering VulnerabilityEPSS 0.6%CVE-2024-50358HIGHA CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKIEPSS 0.5%CVE-2026-19593CRITICALOpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If tEPSS 0.5%CVE-2026-73027HIGHWindows Setup Files Cleanup Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-27889LOWWing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injectionEPSS 0.5%CVE-2026-35650HIGHOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationEPSS 0.5%CVE-2026-44774MEDIUMTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=falseEPSS 0.5%