Skip to content
OpenAdvisories

Weakness (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Base Incomplete

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

How to prevent it (4 mitigations)

  1. Implementation

    If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.

    For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.

  2. Architecture and Design, Implementation

    If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

  3. Implementation

    For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

  4. Implementation, Architecture and Design

    Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.

Source: MITRE CWE-915

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-54515 Public exploit

    jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

    FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  • Medium 4.8
    CVE-2026-40175 Public exploit

    Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

    Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …

    axios axios node-axios node-axios Debian Ubuntu npm
  • Medium 6.5
    CVE-2025-70559 Public exploit

    Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

    pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file in …

    pdfminer-six pdfminer pdfminer Debian Ubuntu PyPI
  • Medium 5.7
    CVE-2024-57708 Public exploit

    An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, _…