cve.bz

CWE-829: Inclusion of Functionality from Untrusted Control Sphere, page 8

Filter

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

What the weakness is: CWE-829 at MITRE

Related attack patterns (CAPEC): 13
  • CAPEC-175 Code Inclusion Likelihood: Medium · Severity: Very High
  • CAPEC-201 Serialized Data External Linking Likelihood: High · Severity: High
  • CAPEC-228 DTD Injection Severity: Medium
  • CAPEC-251 Local Code Inclusion Severity: Medium
  • CAPEC-252 PHP Local File Inclusion Severity: Medium
  • CAPEC-253 Remote Code Inclusion
  • CAPEC-263 Force Use of Corrupted Files Severity: Medium
  • CAPEC-538 Open-Source Library Manipulation Likelihood: Low · Severity: High
  • CAPEC-549 Local Execution of Code Likelihood: Medium · Severity: High
  • CAPEC-640 Inclusion of Code in Existing Process Likelihood: Low · Severity: High
  • CAPEC-660 Root/Jailbreak Detection Evasion via Hooking Likelihood: Medium · Severity: Very High
  • CAPEC-695 Repo Jacking Likelihood: Medium · Severity: High
  • CAPEC-698 Install Malicious Extension Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-829, as MITRE names them. Credits.

Ask an AI about CWE-829

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-829: Inclusion of Functionality from Untrusted Control Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/829.html and https://cve.bz/cve/cwe/829?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2012-4919EPSS 2.9%

    Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability

  2. 5.3CVE-2019-16951EPSS 1.0%

    A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attack…

  3. 8.8CVE-2019-8154EPSS 1.9%

    A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file…

  4. 3.3CVE-2013-1945EPSS 0.3%

    ruby193 uses an insecure LD_LIBRARY_PATH setting.

  5. 6.5CVE-2019-11742EPSS 1.7%

    A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting s…

  6. 8.1CVE-2019-10666EPSS 1.2%

    An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attac…

  7. 7.5CVE-2019-5479EPSS 1.3%

    An unintended require vulnerability in <v0.5.5 larvitbase-api may allow an attacker to load arbitrary non-production code (JavaScript file).

  8. 7.5CVE-2019-15839EPSS 2.4%

    The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.

  9. 9.8CVE-2019-13589EPSS 4.3%

    The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.

  10. 4.3CVE-2019-4263EPSS 0.9%

    IBM Content Navigator 3.0CD is vulnerable to local file inclusion, allowing an attacker to access a configuration file in the ICN server. IBM X-Force ID: 160015.

  11. 8.1CVE-2019-11770EPSS 1.3%

    In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build …

  12. 8.1CVE-2019-10249EPSS 0.7%

    All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.

  13. 8.8CVE-2019-11591EPSS 1.1%

    The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST[…

  14. 8.8CVE-2019-11590EPSS 1.2%

    The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['actio…

  15. 8.1CVE-2019-10248EPSS 0.4%

    Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts…

  16. 8.1CVE-2019-10240EPSS 0.4%

    Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build ar…

  17. 8.8CVE-2019-9829EPSS 2.0%

    Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohi…

  18. 9.8CVE-2018-17246ExploitEPSS 84%

    Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibl…

  19. 8.1CVE-2018-12120EPSS 4.3%

    Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow r…

  20. 8.8CVE-2018-18387EPSS 1.8%

    playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse.

  21. 9.1CVE-2018-15486EPSS 2.1%

    An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka K…

  22. 6.5CVE-2018-8351EPSS 8.4%

    An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction, aka "Microsoft Browser Information Disclosure Vulnerability." This affects Internet Explorer 11, Microsoft Edge, Inte…

  23. 7.2CVE-2018-1000502EPSS 1.3%

    MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP v…

  24. 7.5CVE-2018-11040EPSS 3.2%

    Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for RES…

  25. 9.8CVE-2017-5397EPSS 3.6%

    The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the fil…

  26. 7.0CVE-2018-1122ExploitEPSS 1.2%

    procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vuln…

  27. 7.5CVE-2018-7422ExploitEPSS 62%

    A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php…

  28. 8.1CVE-2017-14095ExploitEPSS 12%

    A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system.

  29. 9.8CVE-2017-1376EPSS 2.6%

    A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.

  30. 8.1CVE-2017-6381EPSS 3.9%

    A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development de…

  31. 9.8CVE-2010-2076EPSS 9.8%

    Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, w…

  32. 9.8CVE-2004-0285ExploitEPSS 7.8%

    PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.

  33. 9.8CVE-2004-0030ExploitEPSS 7.3%

    PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVIEW 2.61 allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter t…