CWE-487: Reliance on Package-level Scope
Description
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
The purpose of package scope is to prevent accidental access by other parts of a program. This is an ease-of-software-development feature but not a security feature.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Medium
- Status
- Incomplete
Common consequences
- Confidentiality
Read Application Data
Any data in a Java package can be accessed outside of the Java framework if the package is distributed.
- Integrity
Modify Application Data
The data in a Java class can be modified by anyone outside of the Java framework if the package is distributed.
Potential mitigations
- Architecture and DesignImplementation
Data should be private static and final whenever possible. This will assure that your code is protected by instantiating early, preventing access and tampering.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.