CWE-1061: Insufficient Encapsulation
Description
The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.
- Abstraction
- ClassAn abstract weakness, independent of any specific language or technology.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- Access Control
Varies by Context; Bypass Protection Mechanism
An attacker can access data or methods that were not intended to be accessible.
- Other
Reduce Maintainability; Increase Analytical Complexity
This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.
Related weaknesses
Parent weaknesses
Child weaknesses
- CWE-766Critical Data Element Declared Public
- CWE-1054Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
- CWE-1057Data Access Operations Outside of Expected Data Manager Component
- CWE-1062Parent Class with References to Child Class
- CWE-1083Data Access from Outside Expected Data Manager Component
- CWE-1090Method Containing Access of a Member Element from Another Class
- CWE-1100Insufficient Isolation of System-Dependent Functions
- CWE-1105Insufficient Encapsulation of Machine-Dependent Functionality
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.