CWE-610 is Externally Controlled Reference to a Resource in Another Sphere. The flaw arises when the product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. The database currently holds 14 vulnerabilities mapped to CWE-610 and none of them are in the CISA Known Exploited Vulnerabilities catalog.
Analyzing data...
No vulnerability data in CISA KEV for CWE-610
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
| Impact | Scope | Explanation |
|---|---|---|
| Read Application Data, Modify Application Data | Confidentiality, Integrity | An adversary could read or modify data, depending on how the resource is intended to be used. |
| Gain Privileges or Assume Identity | Access Control | An adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms. |
Below are representative vulnerabilities related to this CWE, prioritized by severity.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
en
