CWE-610Externally Controlled Reference to a Resource in Another Sphere

Abstraction: Class · CVEs in our corpus: 241

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Last updated: 21 August 2026 22:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 2 framework(s): CAPEC 1 (partial) · STIG oracle linux 8 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SI-22 Information Diversity
PR.PS-06
AC-3 Access Enforcement
AC-4 Information Flow Enforcement

Detect

Catch it (CSF Detect / Respond)

DE.CM-09

Harden

Shrink the surface (DISA STIG)

3 hardening rules · 2 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (1)AI-assisted

Control	Title	Family	Why it addresses this CWE
`SI-22`	Information Diversity	SI	Limits impact of an externally controlled reference to a primary information resource by switching to an identified alternative.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2022-27593` KEV	10.0	10.0	0.8791	2022-09-08
`CVE-2017-16088`	7.9	10.0	0.0349	2018-06-07
`CVE-2020-14057`	7.7	9.8	0.0258	2020-07-01
`CVE-2025-0111` KEV	7.7	6.5	0.0196	2025-02-12
`CVE-2019-7290`	7.6	10.0	0.0103	2019-12-18
`CVE-2021-44041`	7.6	9.8	0.0175	2021-12-14
`CVE-2020-9752`	7.5	9.8	0.0115	2020-03-23
`CVE-2021-43685`	7.5	9.8	0.0119	2021-12-01
`CVE-2025-22144`	7.4	9.8	0.0076	2025-01-13
`CVE-2026-47643`	7.4	9.8	0.0075	2026-06-09
`CVE-2022-2633`	7.3	7.5	0.2719	2022-09-06
`CVE-2022-39206`	7.3	9.9	0.0175	2022-09-13
`CVE-2021-30245`	7.2	8.8	0.0494	2021-04-15
`CVE-2022-20239`	7.2	9.8	0.0028	2022-08-10
`CVE-2021-43844`	7.1	8.8	0.0333	2021-12-20
`CVE-2023-39542`	7.1	8.8	0.0335	2023-11-27
`CVE-2024-10979`	7.1	8.8	0.0439	2024-11-14
`CVE-2023-35985`	7.0	8.8	0.0267	2023-11-27
`CVE-2021-41244`	6.9	9.1	0.0283	2021-11-15
`CVE-2023-40194`	6.9	8.8	0.0200	2023-11-27
`CVE-2024-32980`	6.9	9.1	0.0049	2024-05-08
`CVE-2024-5823`	6.9	9.1	0.0054	2024-10-29
`CVE-2020-25161`	6.8	8.8	0.0151	2021-02-23
`CVE-2021-27648`	6.8	9.0	0.0284	2021-04-28
`CVE-2021-27406`	6.7	8.8	0.0100	2022-10-14