CWE-621Variant

Variable Extraction Error

Incomplete in the CWE catalog · 1 CVE mapped

1
CVEs mapped
9.8
Median CVSS
What it is

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.

Recent examples
9.8cvss
CVE-2018-6334

Multipart-file uploads call variables to be improperly registered in the global scope

🔥 A multipart-file upload can accidentally unleash a world of chaos! This vulnerability lets variables slip into the global scope without being properly declared, a recipe for disaster! ⚠️ Think of it like a restaurant kitchen where ingredients are thrown together without a proper recipe. If a chef doesn't label ingredients before mixing them in a dish, who knows what unexpected flavors might come out? That's how this flaw can lead to unpredictable behavior in your system! An attacker could exploit this oversight to manipulate variables unexpectedly, potentially leading to critical application failures or accidental data exposure. It's like a surprise dish at a restaurant that could either delight or disgust customers—only in this case, it’s your application at stake!

CRITICAL
2%
epss
The record
Technical detail
CWE ID
CWE-621
Abstraction
Variant
Structure
Simple
Status
Incomplete