CWE-610: Externally Controlled Reference to a Resource in Another Sphere

What is CWE-610?

CWE-610 is Externally Controlled Reference to a Resource in Another Sphere. The flaw arises when the product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. The database currently holds 18 vulnerabilities mapped to CWE-610 and none of them are in the CISA Known Exploited Vulnerabilities catalog.

OWASP TOP 10:2025 RANK5 — A05:2025 — Injection
Related CVES (365 days)18
AbstractionClass
Likelihood of exploit-

Vulnerabilities mapped to CWE-610

18 vulnerabilities157% increase year over year

No data

No vulnerability data in CISA KEV for CWE-610

Official definition

ByMitre CWE

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Characteristics

Modes of introduction

  • Architecture and Design: COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Common consequences

ImpactScopeExplanation
Read Application Data, Modify Application DataConfidentiality, IntegrityAn adversary could read or modify data, depending on how the resource is intended to be used.
Gain Privileges or Assume IdentityAccess ControlAn adversary that can supply a reference to an unintended resource can potentially access a resource that they do not have privileges for, thus bypassing existing access control mechanisms.

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

Sources (2)
MITRE CWE
CWE Terms of Use

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan
More resources & insights

Explore more resources from CyStack

Website security reports

Review CyStack's security rating and practical recommendations for websites and edge assets.

Learn more

CyStack research

Explore cybersecurity research from our team of security specialists.

Learn more

Cybersecurity knowledge

Browse practical cybersecurity knowledge across CyStack's articles and guides.

Learn more