CWE-493—Critical Public Variable Without Final Modifier

名称

Critical Public Variable Without Final Modifier

描述

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.

常见后果

范围：

Integrity

影响：

Modify Application Data

注释：

The object could potentially be tampered with.

范围：

Confidentiality

影响：

Read Application Data

注释：

The object could potentially allow the object to be read.

相关 CWE

• CWE-668Exposure of Resource to Wrong Sphere