CWE-15 applies when one or more system settings or configuration elements can be controlled by a user from outside. MITRE says allowing this can disrupt service or make the application behave in unexpected, and potentially malicious, ways.
The record covers products that are not tied to one technology, and it lists ICS and OT among the platforms, where a changed setting can have physical consequences.
How it happens
Settings are values the application trusts. A path, a timeout, a mode flag, a hostname, a logging level. The weakness appears when a request parameter, a form field, a message or a file supplied by a user ends up deciding one of those values.
Typical routes:
- A parameter is passed directly into a call that changes an environment or system setting.
- A feature meant for administrators is reachable by anyone who can send the right request.
- A configuration value is built from user input without checking it against an allowed set.
Because settings sit underneath the application logic, a change can affect every user at once.
What an attacker gains
MITRE lists the technical impact as other, varying by context. That is accurate. A changed log level hides activity. A changed path redirects reads. A changed timeout or limit degrades service. A changed mode can switch off a safeguard. The outcome depends on what the setting does.
How to find it
The record names automated static analysis. Tools that model data flow can see where external input reaches a call that sets configuration.
Add a manual pass:
- List every setting the application can change at runtime.
- For each one, find the code path that changes it and who can trigger it.
- Check that the value is validated against a fixed list or range.
How to fix it
- Keep configuration out of user reach. Read it at startup from a protected source, not per request.
- Where users may choose, offer a fixed menu and map each choice to a safe value on the server.
- Require authorization on every action that changes a setting, and log the change.
- Run the process with the least privilege it needs, so a changed setting cannot reach far.
- Validate any accepted value for type, range and format.
Quick check
Why is this hard to rank by severity?
The impact depends entirely on the setting. A cosmetic flag is harmless, while a security control toggle is serious.
