CWE-608: Struts: Non-private Field in ActionForm Class
Description
An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- IntegrityConfidentiality
Modify Application Data; Read Application Data
Potential mitigations
- Implementation
Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.