CWE-766—Critical Data Element Declared Public

名称

Critical Data Element Declared Public

描述

The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.

This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

常见后果

范围：

Integrity, Confidentiality

影响：

Read Application Data, Modify Application Data

注释：

Making a critical variable public allows anyone with access to the object in which the variable is contained to alter or read the value.

范围：

Other

影响：

Reduce Maintainability

相关 CWE

• CWE-732Incorrect Permission Assignment for Critical ResourceHigh
• CWE-1061Insufficient Encapsulation