CWE-493—Critical Public Variable Without Final Modifier

Weakness Name

Critical Public Variable Without Final Modifier

Description

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.

Common Consequences

Scope:

Integrity

Impact:

Modify Application Data

Notes:

The object could potentially be tampered with.

Scope:

Confidentiality

Impact:

Read Application Data

Notes:

The object could potentially allow the object to be read.

Related Weaknesses

• CWE-668Exposure of Resource to Wrong Sphere