目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-15 系统设置或配置在外部可控制 类漏洞列表 66

CWE-15 系统设置或配置在外部可控制 类弱点 66 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-15 指外部控制系统或配置设置的漏洞，属于配置管理缺陷。攻击者通常通过篡改环境变量、注册表或配置文件，诱导系统执行非预期行为或导致服务中断。开发者应避免直接信任用户输入，采用白名单验证机制限制可配置项，并在代码中硬编码关键安全参数，同时实施严格的权限控制，防止未授权修改。

MITRE CWE 官方描述
CWE：CWE-15 External Control of System or Configuration Setting 英文：One or more system settings or configuration elements can be externally controlled by a user. 允许外部控制系统设置可能会破坏服务，或导致应用程序以不可预知且潜在恶意的方式运行。
常见影响 (1)
Other Varies by Context
缓解措施 (3)
Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Implementation, Architecture and Design Because setting manipulation covers a diverse set of functions, any attempt at illustrating it will inevitably be incomplete. Rather than searching for a tight-knit relationship between the functions addressed in the setting manipulation category, take a step back and consider the sorts of system values that an attacker should not be allowed to control.
Implementation, Architecture and Design In general, do not allow user-provided or otherwise untrusted data to control sensitive values. The leverage that an attacker gains by controlling these values is not always immediately obvious, but do not underestimate the creativity of the attacker.
代码示例 (2)
The following C code accepts a number as one of its command line parameters and sets it as the host ID of the current machine.
... sethostid(argv[1]); ...
Bad · C
The following Java code snippet reads a string from an HttpServletRequest and sets it as the active catalog for a database Connection.
... conn.setCatalog(request.getParameter("catalog")); ...
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-16708 IBM Db2 Mirror for i 配置错误漏洞 — Db2 Mirror for i 8.3 High 2026-08-14
CVE-2026-73661 FreePBX 配置错误漏洞 — framework 8.6 High 2026-08-13
CVE-2026-66065 Q00 Ouroboros 配置错误漏洞 — ouroboros 8.4 High 2026-08-03
CVE-2026-56567 HCL iControl 配置错误漏洞 — HCL iControl 5.1 Medium 2026-07-31
CVE-2026-46485 lissy93 dashy 配置错误漏洞 — dashy 8.2 High 2026-07-15
CVE-2026-44768 SAP crm - webclient ui 配置错误漏洞 — SAP CRM (WebClient UI) 4.1 Medium 2026-07-14
CVE-2026-0418 NETGEAR多款产品 安全漏洞 — CBR750 - - 2026-06-09
CVE-2026-46399 HAX 操作系统命令注入漏洞 — haxcms-nodejs - - 2026-06-05
CVE-2026-1784 Red Hat OpenShift Container Platform 安全漏洞 — Red Hat OpenShift Container Platform 4.13 8.8 High 2026-06-02
CVE-2019-25716 Dräger多款产品 安全漏洞 — Infinity Delta 6.5 Medium 2026-06-01
CVE-2026-45087 dalfox 访问控制错误漏洞 — dalfox 10.0 Critical 2026-05-27
CVE-2026-43531 OpenClaw 安全漏洞 — OpenClaw 7.3 High 2026-05-05
CVE-2026-41384 OpenClaw 安全漏洞 — OpenClaw 7.8 High 2026-04-28
CVE-2026-41294 OpenClaw 安全漏洞 — OpenClaw 8.6 High 2026-04-20
CVE-2026-0232 Palo Alto Networks Cortex XDR Agent 安全漏洞 — Cortex XDR Agent 6.0 - 2026-04-13
CVE-2026-35650 OpenClaw 安全漏洞 — OpenClaw 7.5 High 2026-04-10
CVE-2026-33092 Acronis True Image 安全漏洞 — Acronis True Image OEM 7.8AI High AI 2026-04-10
CVE-2026-30817 TP-Link Archer AX53 安全漏洞 — AX53 v1.0 5.7AI Medium AI 2026-04-08
CVE-2026-30816 TP-Link Archer AX53 安全漏洞 — AX53 v1.0 5.7AI Medium AI 2026-04-08
CVE-2026-22177 OpenClaw 安全漏洞 — OpenClaw 6.1 Medium 2026-03-18
CVE-2026-21422 Dell PowerScale OneFS 安全漏洞 — PowerScale OneFS 3.4 Low 2026-03-04
CVE-2026-27203 eBay API MCP Server 注入漏洞 — ebay-mcp 8.3 High 2026-02-20
CVE-2025-13091 WordPress plugin Shopire 安全漏洞 — Shopire 4.3 Medium 2026-02-19
CVE-2026-22708 Cursor 安全漏洞 — cursor 9.1AI Critical AI 2026-01-14
CVE-2026-0495 SAP Fiori App Intercompany Balance Reconciliation 安全漏洞 — SAP Fiori App (Intercompany Balance Reconciliation) 5.1 Medium 2026-01-13
CVE-2025-64726 Socket Firewall 代码问题漏洞 — firewall-release 7.8 - 2025-11-13
CVE-2025-62527 Taguette 安全漏洞 — taguette 7.1 High 2025-10-20
CVE-2025-43792 Liferay Portal和Liferay DXP 安全漏洞 — Portal 8.1AI High AI 2025-09-15
CVE-2025-41452 Danfoss AK-SM8xxA Series 安全漏洞 — AK-SM8xxA Series 5.3AI Medium AI 2025-08-22
CVE-2025-8283 Red Hat Enterprise Linux 安全漏洞 3.7 Low 2025-07-28

CWE-15（系统设置或配置在外部可控制） 是常见的弱点类别，本平台收录该类弱点关联的 66 条 CVE 漏洞。