CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Description

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Abstraction: ClassAn abstract weakness, independent of any specific language or technology.
Likelihood of exploit: Not rated by MITRE
Status: Draft

Common consequences

ConfidentialityIntegrity
Read Application Data; Modify Application Data
An adversary could read or modify data, depending on how the resource is intended to be used.
Access Control
Gain Privileges or Assume Identity
An adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms.

Related weaknesses

Parent weaknesses

CWE-664Improper Control of a Resource Through its Lifetime

Child weaknesses

CAPEC attack patterns that exploit it

CAPEC-219XML Routing Detour Attacks

Common consequences

ConfidentialityIntegrity

Read Application Data; Modify Application Data

An adversary could read or modify data, depending on how the resource is intended to be used.

Access Control

Gain Privileges or Assume Identity

An adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms.