cve.bz

CWE-15: External Control of System or Configuration Setting

Filter

One or more system settings or configuration elements can be externally controlled by a user.

What the weakness is: CWE-15 at MITRE. OWASP Top 10: A02:2025 Security Misconfiguration

Related attack patterns (CAPEC): 10
  • CAPEC-13 Subverting Environment Variable Values Likelihood: High · Severity: Very High
  • CAPEC-69 Target Programs with Elevated Privileges Likelihood: High · Severity: Very High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
  • CAPEC-146 XML Schema Poisoning Likelihood: Low · Severity: High
  • CAPEC-176 Configuration/Environment Manipulation Severity: Medium
  • CAPEC-203 Manipulate Registry Information Severity: Medium
  • CAPEC-270 Modification of Registry Run Keys Likelihood: Medium · Severity: Medium
  • CAPEC-271 Schema Poisoning Likelihood: Low · Severity: High
  • CAPEC-579 Replace Winlogon Helper DLL

The attack patterns MITRE's CAPEC relates to CWE-15, as MITRE names them. Credits.

Ask an AI about CWE-15

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-15: External Control of System or Configuration Setting and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/15.html and https://cve.bz/cve/cwe/15?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2026-13292

    IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by inject…

  2. 7.1CVE-2026-121614EPSS 0.1%

    Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a d…

  3. 8.7CVE-2026-121427EPSS 0.3%

    AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shou…

  4. 4.6CVE-2025-68403EPSS 0.1%

    An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have a…

  5. 7.7CVE-2026-110845EPSS 0.3%

    n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. Authen…

  6. 5.5CVE-2026-96218EPSS 0.6%

    Improper access control in Windows Update Stack allows an authorized attacker to perform tampering locally.

  7. 7.3CVE-2026-96188EPSS 0.4%

    External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

  8. 7.8CVE-2026-73027EPSS 0.5%

    External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

  9. 8.4CVE-2026-107818EPSS 0.4%

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database…

  10. 7.1CVE-2026-107503EPSS 0.2%

    In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect (OIDC) provider settings, from an arbitrary cross-origin U…

  11. 7.3CVE-2026-94577EPSS 0.1%

    A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that …

  12. 9.1CVE-2026-105294EPSS 0.2%

    Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additi…

  13. 7.2CVE-2026-103442EPSS 0.3%

    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

  14. 5.3CVE-2026-54918EPSS 0.4%

    NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOX_DT_LIBRARY_URL in tests/test_configuration.py is a free-form tracked constant that…

  15. 10.0CVE-2026-87987EPSS 0.6%

    An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enablin…

  16. 8.6CVE-2026-85217EPSS 0.2%

    A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated F…

  17. 7.7CVE-2026-13745EPSS 0.7%

    A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env file…

  18. 9.8CVE-2026-19593EPSS 0.5%

    OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree se…

  19. 7.3CVE-2026-19592EPSS 0.2%

    OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepa…

  20. 7.5CVE-2026-16708EPSS 0.4%

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration.

  21. 8.4CVE-2026-19884EPSS 0.2%

    In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such …

  22. 8.6CVE-2026-73661EPSS 0.3%

    FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builti…

  23. 8.4CVE-2026-66065EPSS 0.2%

    Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RC…

  24. 3.3CVE-2026-56567EPSS 0.1%

    HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.

  25. 8.2CVE-2026-46485EPSS 0.4%

    Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality des…

  26. 4.1CVE-2026-44768EPSS 0.3%

    SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability ha…

  27. 4.3CVE-2026-0418EPSS 0.2%

    Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network to tamper with the system.

  28. 9.4CVE-2026-46399EPSS 0.3%

    HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Gi…

  29. 8.8CVE-2026-1784EPSS 0.2%

    The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controll…

  30. 7.1CVE-2019-25716EPSS 0.4%

    Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote attackers to cause the monitor to reboot by sending a malformed network packet. Attackers can repeatedly send malforme…

  31. 10.0CVE-2026-45087ExploitEPSS 8.7%

    Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server), the server binds to 0.0.0.0:6664 by default and requires no API key unless the…

  32. 7.5CVE-2026-44417EPSS 0.7%

    The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apac…

  33. 6.4CVE-2026-44774EPSS 0.5%

    Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the provi…

  34. 8.8CVE-2026-41489EPSS 0.1%

    Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1, two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihol…

  35. 7.0CVE-2026-43531EPSS 0.2%

    OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub reso…

  36. 8.5CVE-2026-41384EPSS 0.1%

    OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious wor…

  37. 9.2CVE-2026-41176ExploitEPSS 33%

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including …

  38. 8.5CVE-2026-41294EPSS 0.1%

    OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override run…

  39. 4.0CVE-2026-0232EPSS 0.1%

    A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection.

  40. 7.7CVE-2026-35650EPSS 0.5%

    OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malforme…

  41. 7.8CVE-2026-33092EPSS 0.2%

    Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.

  42. 7.5CVE-2026-22750EPSS 0.2%

    When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer unde…

  43. 6.8CVE-2026-30817EPSS 0.3%

    An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may all…

  44. 6.8CVE-2026-30816EPSS 0.3%

    An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.  Successful exploitation may a…

  45. 6.9CVE-2026-22177EPSS 0.4%

    OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODE_OPTIONS or LD_* through configuration …

  46. 6.7CVE-2026-21422EPSS 0.1%

    Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to…

  47. 8.3CVE-2026-27203EPSS 0.4%

    eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_us…

  48. 4.3CVE-2025-13091EPSS 0.4%

    The Shopire theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the shopire_admin_install_plugin() function in all versions up to, and including, 1.0.57. This makes it possible for au…

  49. 7.2CVE-2026-22708EPSS 0.8%

    Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without…

  50. 5.1CVE-2026-0495EPSS 0.2%

    SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and av…