CWE-487 — Reliance on Package-level Scope
CWE-487: Reliance on Package-level Scope
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | Medium |
Description
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
The purpose of package scope is to prevent accidental access by other parts of a program. This is an ease-of-software-development feature but not a security feature.
Common consequences
- Confidentiality: Read Application Data
- Integrity: Modify Application Data
Mitigations
Architecture and Design — Data should be private static and final whenever possible. This will assure that your code is protected by instantiating early, preventing access and tampering.
References
- CWE page: https://cwe.mitre.org/data/definitions/487.html
- CWE list: https://cwe.mitre.org/data/index.html