CWE · MITRE source
CWE-642External Control of Critical State Data
The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
If an attacker can modify the state information without detection, then it could be used to perform unauthorized actions or access unexpected resources, since the application programmer does not expect that the state can be changed. State information can be stored in various locations such as a cookie, in a hidden web form field, input parameter or argument, an environment variable, a database record, within a settings file, etc. All of these locations have the potential to be modified by an attacker. When this state information is used to control security or determine resource usage, then it may create a vulnerability. For example, an application may perform authentication, then save the state in an "authenticated=true" cookie. An attacker may simply create this cookie in order to bypass the authentication.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 16 mapping(s) from 6 framework(s): ATT&CK 9 (mostly) · STIG oracle linux 9 2 (mostly) · CAPEC 2 (partial) · STIG oracle linux 8 1 (mostly) · OWASP-Web 1 (mostly) · STIG rhel 7 1 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
NIST 800-53 r5 controls that address this weakness (4)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-22 | Information Diversity | SI | Directly counters external corruption or unavailability of critical state data by mandating and using alternative sources for essential functions. |
SI-9 | Information Input Restrictions | SI | Limits external actors' ability to control critical state through input channels. |
CM-3 | Configuration Change Control | CM | Monitors, approves, and documents changes to critical configuration state data, mitigating external control risks. |
IA-4 | Identifier Management | IA | Requires authorization and prevents reuse, mitigating external control of critical identifier state data. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2018-15382 | 5.5 | 8.6 | 0.0128 | 2018-10-05 |
CVE-2019-9496 | 5.5 | 7.5 | 0.0522 | 2019-04-17 |
CVE-2020-27872 | 5.5 | 8.8 | 0.0090 | 2021-02-04 |
CVE-2023-0575 | 5.5 | 7.2 | 0.0078 | 2023-02-09 |
CVE-2025-49090 | 5.5 | 7.1 | 0.0042 | 2025-10-02 |
CVE-2026-29146 UPD | 5.5 | 7.5 | 0.0349 | 2026-04-09 |
CVE-2017-0928 | 3.5 | 6.1 | 0.0104 | 2018-06-04 |
CVE-2020-1976 | 3.5 | 4.7 | 0.0028 | 2020-02-12 |
CVE-2020-26186 | 3.5 | 6.8 | 0.0036 | 2021-01-08 |
CVE-2022-22154 | 3.5 | 6.8 | 0.0024 | 2022-01-19 |
CVE-2022-32859 | 3.5 | 5.3 | 0.0053 | 2022-11-01 |
CVE-2024-22387 | 3.5 | 6.8 | 0.0031 | 2024-07-11 |
CVE-2024-8754 | 3.5 | 6.4 | 0.0041 | 2024-09-12 |
CVE-2025-54566 UPD | 3.5 | 4.2 | 0.0024 | 2025-07-25 |
CVE-2025-26787 | 3.5 | 4.7 | 0.0013 | 2025-12-22 |
CVE-2024-58265 UPD | 1.5 | 3.1 | 0.0039 | 2025-07-27 |