Weakness (CWE)
CWE-642: External Control of Critical State Data
The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
More detail
If an attacker can modify the state information without detection, then it could be used to perform unauthorized actions or access unexpected resources, since the application programmer does not expect that the state can be changed.
State information can be stored in various locations such as a cookie, in a hidden web form field, input parameter or argument, an environment variable, a database record, within a settings file, etc. All of these locations have the potential to be modified by an attacker. When this state information is used to control security or determine resource usage, then it may create a vulnerability. For example, an application may perform authentication, then save the state in an "authenticated=true" cookie. An attacker may simply create this cookie in order to bypass the authentication.
How to prevent it (6 mitigations)
-
Architecture and Design
Understand all the potential locations that are accessible to attackers. For example, some programmers assume that cookies and hidden form fields cannot be modified by an attacker, or they may not consider that environment variables can be modified before a privileged program is invoked.
-
Architecture and Design
Store state information and sensitive data on the server side only.
Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions.
If information must be stored on the client, do not do so without encryption and integrity checking, or otherwise having a mechanism on the server side to catch tampering. Use a message authentication code (MAC) algorithm, such as Hash Message Authentication Code (HMAC) [REF-529]. Apply this against the state or sensitive data that has to be exposed, which can guarantee the integrity of the data - i.e., that the data has not been modified. Ensure that a strong hash function is used (CWE-328).
-
Architecture and Design
Store state information on the server side only. Ensure that the system definitively and unambiguously keeps track of its own state and user state and has rules defined for legitimate state transitions. Do not allow any application user to affect state directly in any way other than through legitimate actions leading to state transitions.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
With a stateless protocol such as HTTP, use some frameworks can maintain the state for you.
Examples include ASP.NET View State and the OWASP ESAPI Session Management feature.
Be careful of language features that provide state support, since these might be provided as a convenience to the programmer and may not be considering security.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Operation, Implementation
When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.
Source: MITRE CWE-642
22 results · Feed
-
High 8.7
Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, …
-
Medium 4.3
This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, mac…
-
Medium 4.3
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iP…
-
Medium 4.3
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPa…
-
Critical 9.1
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as…
-
Medium 4.6
OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery
OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to uninte…
-
High 7.5
Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…
-
Medium 4.7
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin C…
-
High 7.1
The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficien…
-
Low 3.1
Unauthenticated Nonce Increment in snow
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
-
Medium 4.2
hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.
-
Medium 6.4
External Control of Critical State Data in GitLab
An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider i…
-
Medium 6.8
External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface a…
-
High 7.2
Remote Code Execution
External Control of Critical State Data, Improper Control of Generation of Code ('Code Injection') vulnerability in YugaByte, Inc. Yugabyte DB on Windows, Linux, MacOS, iOS (DevopsBase.Java:execCommand, TableManager.Java:runCommand modules) allows API Manipul…
-
Medium 5.3
A logic issue was addressed with improved state management. This issue is fixed in iOS 16. Deleted contacts may still a…
-
Medium 6.8
Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS
In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Junos OS allows an attacker who is able to make physical changes to the cabling of the device to cause a…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R745…
-
Medium 6.8
Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local at…
-
Medium 4.7
GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.
A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5…
-
Unscored —
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps
An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP mode. All version of hostapd with SAE support are vulnerable. An attacker may f…
-
Unscored —
Cisco HyperFlex Software Static Signing Key Vulnerability
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present in all Cisco HyperFlex systems. An attacker could exploit th…
-
Medium 6.1
Bypassing Sanitization using DOM clobbering in html-janitor
html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.