CWE-493 - Critical Public Variable Without Final Modifier
- 摘要：Variant
- 结构：Simple
- 状态：Draft
- 发布日期：2006-07-19
- 更新日期：2025-12-11
名称
Critical Public Variable Without Final Modifier
描述
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.
常见后果
范围：Integrity
影响：Modify Application Data
注释：The object could potentially be tampered with.
范围：Confidentiality
影响：Read Application Data
注释：The object could potentially allow the object to be read.