logo

CWE-493 - Critical Public Variable Without Final Modifier

CWE-493 High

  • Abstraction:
  • Variant
  • Structure:
  • Simple
  • Status:
  • Draft
Weakness Name

Critical Public Variable Without Final Modifier

Description

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.

Common Consequences

Scope: Integrity

Impact: Modify Application Data

Notes: The object could potentially be tampered with.

Scope: Confidentiality

Impact: Read Application Data

Notes: The object could potentially allow the object to be read.

Related Weaknesses
  • Release Date:
  • 2006-07-19
  • Latest Modification Date:
  • 2023-06-29

Free security scan for your website