VariantDraft
CWE-493Critical Public Variable Without Final Modifier
Category: other
Description
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.
Common consequences· 2
- Integrity — Modify Application DataThe object could potentially be tampered with.
- Confidentiality — Read Application DataThe object could potentially allow the object to be read.
Potential mitigations· 1
- [Implementation]Declare all public fields as final when possible, especially if it is used to maintain internal state of an Applet or of classes used by an Applet. If a field must be public, then perform all appropriate sanity checks before accessing the field from your code.
References
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.