CWE-493: Critical Public Variable Without Final Modifier
Description
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- High
- Status
- Draft
Common consequences
- Integrity
Modify Application Data
The object could potentially be tampered with.
- Confidentiality
Read Application Data
The object could potentially allow the object to be read.
Potential mitigations
- Implementation
Declare all public fields as final when possible, especially if it is used to maintain internal state of an Applet or of classes used by an Applet. If a field must be public, then perform all appropriate sanity checks before accessing the field from your code.
Related weaknesses
Parent weaknesses
Child weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.