目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-15 系统设置或配置在外部可控制 类漏洞列表 81

CWE-15 系统设置或配置在外部可控制 类弱点 81 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-15 指外部控制系统或配置设置的漏洞，属于配置管理缺陷。攻击者通常通过篡改环境变量、注册表或配置文件，诱导系统执行非预期行为或导致服务中断。开发者应避免直接信任用户输入，采用白名单验证机制限制可配置项，并在代码中硬编码关键安全参数，同时实施严格的权限控制，防止未授权修改。

MITRE CWE 官方描述
CWE：CWE-15 External Control of System or Configuration Setting 英文：One or more system settings or configuration elements can be externally controlled by a user. 允许外部控制系统设置可能会破坏服务，或导致应用程序以不可预知且潜在恶意的方式运行。
常见影响 (1)
Other Varies by Context
缓解措施 (3)
Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Implementation, Architecture and Design Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.
Implementation, Architecture and Design In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.
代码示例 (2)
The following C code accepts a number as one of its command line parameters and sets it as the host ID of the current machine.
... sethostid(argv[1]); ...
Bad · C
The following Java code snippet reads a string from an HttpServletRequest and sets it as the active catalog for a database Connection.
... conn.setCatalog(request.getParameter("catalog")); ...
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-68403 QuRouter 漏洞确认步骤不足 — QuRouter 4.6 Medium 2026-10-15
CVE-2026-110845 n8n 多版本代码执行漏洞（Git节点日志操作） — n8n 7.7 High 2026-10-14
CVE-2026-96188 Microsoft PowerToys 权限提升漏洞 — Microsoft PowerToys 7.3 High 2026-10-13
CVE-2026-73027 Windows Setup文件清理提权漏洞 — Windows 10 Version 1607 7.8 High 2026-10-13
CVE-2026-96218 Windows Update 栈篡改漏洞 — Windows 10 Version 1809 5.5 Medium 2026-10-13
CVE-2026-107818 MariaDB 服务文件 wsrep 启动参数注入漏洞 — server 8.4 High 2026-10-09
CVE-2026-107503 Eclipse Ditto Explorer OIDC重定向导致账户接管 — Ditto Explorer UI 7.1 High 2026-10-08
CVE-2026-94577 Brocade Fabric OS提权漏洞（<9.2.2d/10.0.0系列） — Fabric OS 7.3 High 2026-10-08
CVE-2026-105294 Legcord 1.1.0-1.3.0 通过setConfig注入Chromium开关漏洞 — Legcord 7.4 High 2026-10-05
CVE-2026-103442 PHP MergeAccount 会话密钥对象注入漏洞 — MediaWiki CentralAuth extension 7.2 High 2026-09-30
CVE-2026-54918 NetBox设备类型库 SSRF及测试数据替换漏洞 — devicetype-library 5.3 Medium 2026-09-17
CVE-2026-87987 Mistral AI Mistral Vibe 配置错误漏洞 — mistral-vibe 10.0 Critical 2026-09-11
CVE-2026-85217 Autodesk Fusion 配置错误漏洞 — Fusion 8.6 High 2026-09-10
CVE-2026-19592 OpenAI Codex CLI 配置错误漏洞 — Codex CLI - - 2026-09-01
CVE-2026-19593 OpenAI Codex Desktop 配置错误漏洞 — Codex Desktop - - 2026-09-01
CVE-2026-16708 IBM Db2 Mirror for i 配置错误漏洞 — Db2 Mirror for i 8.3 High 2026-08-14
CVE-2026-73661 FreePBX 配置错误漏洞 — framework 8.6 High 2026-08-13
CVE-2026-66065 Q00 Ouroboros 配置错误漏洞 — ouroboros 8.4 High 2026-08-03
CVE-2026-56567 HCL iControl 配置错误漏洞 — HCL iControl 5.1 Medium 2026-07-31
CVE-2026-46485 lissy93 dashy 配置错误漏洞 — dashy 8.2 High 2026-07-15
CVE-2026-44768 SAP crm - webclient ui 配置错误漏洞 — SAP CRM (WebClient UI) 4.1 Medium 2026-07-14
CVE-2026-0418 NETGEAR多款产品 安全漏洞 — CBR750 - - 2026-06-09
CVE-2026-46399 HAX 操作系统命令注入漏洞 — haxcms-nodejs - - 2026-06-05
CVE-2026-1784 Red Hat OpenShift Container Platform 安全漏洞 — Red Hat OpenShift Container Platform 4.12 8.8 High 2026-06-02
CVE-2019-25716 Dräger多款产品 安全漏洞 — Infinity Delta 6.5 Medium 2026-06-01
CVE-2026-45087 dalfox 访问控制错误漏洞 — dalfox 10.0 Critical 2026-05-27
CVE-2026-43531 OpenClaw 安全漏洞 — OpenClaw 7.3 High 2026-05-05
CVE-2026-41384 OpenClaw 安全漏洞 — OpenClaw 7.8 High 2026-04-28
CVE-2026-41294 OpenClaw 安全漏洞 — OpenClaw 8.6 High 2026-04-20
CVE-2026-0232 Palo Alto Networks Cortex XDR Agent 安全漏洞 — Cortex XDR Agent 6.0 - 2026-04-13

CWE-15（系统设置或配置在外部可控制） 是常见的弱点类别，本平台收录该类弱点关联的 81 条 CVE 漏洞。