CWE-500 — Public Static Field Not Marked Final
CWE-500: Public Static Field Not Marked Final
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Draft |
| Likelihood of exploit | High |
Description
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
Public static variables can be read without an accessor and changed without a mutator by any classes in the application.
Common consequences
- Integrity: Modify Application Data
- Confidentiality: Read Application Data
Mitigations
Architecture and Design — Clearly identify the scope for all critical data elements, including whether they should be regarded as static.
Implementation — Make any static fields private and constant. A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java
References
- CWE page: https://cwe.mitre.org/data/definitions/500.html
- CWE list: https://cwe.mitre.org/data/index.html