CWE-914: Improper Control of Dynamically-Identified Variables
The product does not properly restrict reading from or writing to dynamically-identified variables.
Last updated
Overview
Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.
Real-world CVEs
4 recorded CVEs are caused by CWE-914 (Improper Control of Dynamically-Identified Variables). The highest-severity and most recent are shown first. 0 new CWE-914 CVEs have been recorded so far in 2026 (1 in 2025).
Common consequences
What can happen when CWE-914 is exploited.
Modify Application Data
Affects: Integrity
An attacker could modify sensitive data or program variables.
Execute Unauthorized Code or Commands
Affects: Integrity
Varies by Context, Alter Execution Logic
Affects: Other, Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-914, grouped by where in the lifecycle they apply.
For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
Refactor the code so that internal program variables do not need to be dynamically identified.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
This code uses the credentials sent in a POST request to login a user.
Vulnerable example
//Log user in, and set $isAdmin to true if user is an administratorThe call to extract() will overwrite the existing values of any variables defined previously, in this case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin" equal to "true", thus gaining Admin privileges.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2006-7135 — extract issue enables file inclusion
- CVE-2006-7079 — Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
- CVE-2007-0649 — extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.
- CVE-2006-6661 — extract() enables static code injection
- CVE-2006-2828 — import_request_variables() buried in include files makes post-disclosure analysis confusing
- CVE-2009-0422 — Chain: Dynamic variable evaluation allows resultant remote file inclusion and path traversal.
- CVE-2007-2431 — Chain: dynamic variable evaluation in PHP program used to modify critical, unexpected $_SERVER variable for resultant XSS.
- CVE-2006-4904 — Chain: dynamic variable evaluation in PHP program used to conduct remote file inclusion.
- CVE-2006-4019 — Dynamic variable evaluation in mail program allows reading and modifying attachments and preferences of other users.
Frequently asked questions
Common questions about CWE-914.
- What is CWE-914?
- The product does not properly restrict reading from or writing to dynamically-identified variables.
- What CVEs are caused by CWE-914?
- 4 recorded CVEs are attributed to CWE-914, including CVE-2023-33175, CVE-2024-54198, CVE-2024-24914.
- How do you prevent CWE-914?
- For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.
- What are the consequences of CWE-914?
- Exploiting CWE-914 can lead to: Modify Application Data, Execute Unauthorized Code or Commands, Varies by Context, Alter Execution Logic.
- Is CWE-914 actively exploited?
- 4 recorded CVEs are caused by CWE-914; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-914) (opens in a new tab)
- CWE-914 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-914
Get alerted the moment a new CWE-914 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.