CWE-610Externally Controlled Reference to a Resource in Another Sphere

Abstraction: Class · CVEs in our corpus: 247

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Last updated: 14 October 2026 20:41 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): STIG oracle linux 8 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

SI-22 Information Diversity

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (1)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SI-22`	Information Diversity	SI	Limits impact of an externally controlled reference to a primary information resource by switching to an identified alternative.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2022-27593` KEV	10.0	10.0	0.8791	2022-09-08
`CVE-2017-16088`	7.9	10.0	0.0344	2018-06-07
`CVE-2020-14057`	7.7	9.8	0.0258	2020-07-01
`CVE-2025-0111` KEV	7.7	6.5	0.0200	2025-02-12
`CVE-2019-7290`	7.6	10.0	0.0103	2019-12-18
`CVE-2021-44041`	7.6	9.8	0.0181	2021-12-14
`CVE-2020-9752`	7.5	9.8	0.0115	2020-03-23
`CVE-2021-43685`	7.5	9.8	0.0123	2021-12-01
`CVE-2022-2633`	7.5	7.5	0.3382	2022-09-06
`CVE-2026-47643`	7.5	9.8	0.0097	2026-06-09
`CVE-2025-22144`	7.4	9.8	0.0076	2025-01-13
`CVE-2022-39206`	7.3	9.9	0.0215	2022-09-13
`CVE-2021-30245`	7.2	8.8	0.0494	2021-04-15
`CVE-2022-20239`	7.2	9.8	0.0029	2022-08-10
`CVE-2021-43844`	7.1	8.8	0.0344	2021-12-20
`CVE-2023-39542`	7.1	8.8	0.0377	2023-11-27
`CVE-2024-10979`	7.1	8.8	0.0439	2024-11-14
`CVE-2023-35985`	7.0	8.8	0.0267	2023-11-27
`CVE-2020-25161`	6.9	8.8	0.0156	2021-02-23
`CVE-2021-41244`	6.9	9.1	0.0289	2021-11-15
`CVE-2023-40194`	6.9	8.8	0.0200	2023-11-27
`CVE-2024-32980`	6.9	9.1	0.0049	2024-05-08
`CVE-2024-5823`	6.9	9.1	0.0055	2024-10-29
`CVE-2021-27648`	6.8	9.0	0.0284	2021-04-28
`CVE-2021-27406`	6.8	8.8	0.0121	2022-10-14