Read Time:40 Second

Description

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

Public static variables can be read without an accessor and changed without a mutator by any classes in the application.

When a field is declared public but not final, the field can be read and written to by arbitrary Java code.

Modes of Introduction:

– Implementation

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-493

 

Consequences

Integrity: Modify Application Data

The object could potentially be tampered with.

Confidentiality: Read Application Data

The object could potentially allow the object to be read.

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Clearly identify the scope for all critical data elements, including whether they should be regarded as static.

Phase: Implementation

Description: 

CVE References