Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-500:Public Static Field Not Marked Final
Weakness ID:500
Version:v4.17
Weakness Name:Public Static Field Not Marked Final
Vulnerability Mapping:Allowed
Abstraction:Variant
Structure:Simple
Status:Draft
Likelihood of Exploit:High
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

▼Extended Description

Public static variables can be read without an accessor and changed without a mutator by any classes in the application.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowedV493Critical Public Variable Without Final Modifier
Nature: ChildOf
Mapping: Allowed
Type: Variant
ID: 493
Name: Critical Public Variable Without Final Modifier
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC849The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)
MemberOfProhibitedC1002SFP Secondary Cluster: Unexpected Entry Points
MemberOfProhibitedC1139SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
MemberOfProhibitedC1403Comprehensive Categorization: Exposed Resource
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 849
Name: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1002
Name: SFP Secondary Cluster: Unexpected Entry Points
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1139
Name: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1403
Name: Comprehensive Categorization: Exposed Resource
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-274High likelihood of exploit
MemberOfProhibitedBSBOSS-318Modify Application Data (impact)
MemberOfProhibitedBSBOSS-328Read Application Data (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-274
Name: High likelihood of exploit
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-318
Name: Modify Application Data (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-328
Name: Read Application Data (impact)
▼Relevant To View
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC1002SFP Secondary Cluster: Unexpected Entry Points
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1002
Name: SFP Secondary Cluster: Unexpected Entry Points
Relevant to the view"Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java - (1133)"
NatureMappingTypeIDName
MemberOfProhibitedC1139SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1139
Name: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
▼Background Detail

When a field is declared public but not final, the field can be read and written to by arbitrary Java code.

▼Common Consequences
ScopeLikelihoodImpactNote
IntegrityN/AModify Application Data

The object could potentially be tampered with.

ConfidentialityN/ARead Application Data

The object could potentially allow the object to be read.

Scope: Integrity
Likelihood: N/A
Impact: Modify Application Data
Note:

The object could potentially be tampered with.

Scope: Confidentiality
Likelihood: N/A
Impact: Read Application Data
Note:

The object could potentially allow the object to be read.

▼Potential Mitigations
Phase:Architecture and Design
Mitigation ID:
Strategy:
Effectiveness:
Description:

Clearly identify the scope for all critical data elements, including whether they should be regarded as static.

Note:

Phase:Implementation
Mitigation ID:
Strategy:
Effectiveness:
Description:

Make any static fields private and constant.

A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java

Note:

▼Modes Of Introduction
Phase: Implementation
Note:

N/A

▼Applicable Platforms
Languages
Class: C++(Undetermined Prevalence)
Class: Java(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

The following examples use of a public static String variable to contain the name of a property/configuration file for the application.

Language: ( code)
N/A

Language: C++(Bad code)
class SomeAppClass { public: static string appPropertiesConfigFile = "app/properties.config"; ... }

Language: Java(Bad code)
public class SomeAppClass { public static String appPropertiesFile = "app/Application.properties"; ... }

Language: ( code)
N/A

Having a public static variable that is not marked final (constant) may allow the variable to the altered in a way not intended by the application. In this example the String variable can be modified to indicate a different on nonexistent properties file which could cause the application to crash or caused unexpected behavior.

Language: C++(Good code)
class SomeAppClass { public: static const string appPropertiesConfigFile = "app/properties.config"; ... }

Language: Java(Good code)
public class SomeAppClass { public static final String appPropertiesFile = "app/Application.properties"; ... }

▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      Automated Static Analysis
      Detection Method ID:DM-14
      Description:

      Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

      Effectiveness:High
      Note:

      N/A

      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      CLASPN/AN/AOverflow of static internal buffer
      The CERT Oracle Secure Coding Standard for Java (2011)OBJ10-JN/ADo not use public static nonfinal variables
      Software Fault PatternsSFP28N/AUnexpected access points
      Taxonomy Name: CLASP
      Entry ID: N/A
      Fit: N/A
      Entry Name: Overflow of static internal buffer
      Taxonomy Name: The CERT Oracle Secure Coding Standard for Java (2011)
      Entry ID: OBJ10-J
      Fit: N/A
      Entry Name: Do not use public static nonfinal variables
      Taxonomy Name: Software Fault Patterns
      Entry ID: SFP28
      Fit: N/A
      Entry Name: Unexpected access points
      ▼Related Attack Patterns
      IDName
      ▼References
      Reference ID: REF-18
      Title: The CLASP Application Security Process
      Author: Secure Software, Inc.
      Section:
      Publication:
      Publisher:
      Edition:
      URL:https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
      URL Date:2024-11-17
      Day:N/A
      Month:N/A
      Year:2005
      Details not found