CWE-500: Public Static Field Not Marked Final
Description
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
Public static variables can be read without an accessor and changed without a mutator by any classes in the application.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- High
- Status
- Draft
Common consequences
- Integrity
Modify Application Data
The object could potentially be tampered with.
- Confidentiality
Read Application Data
The object could potentially allow the object to be read.
Potential mitigations
- Architecture and Design
Clearly identify the scope for all critical data elements, including whether they should be regarded as static.
- Implementation
Make any static fields private and constant. A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.