When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Discouraged | C | 668 | Exposure of Resource to Wrong Sphere |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 2 | 7PK - Environment |
| MemberOf | Prohibited | C | 731 | OWASP Top Ten 2004 Category A10 - Insecure Configuration Management |
| MemberOf | Prohibited | C | 963 | SFP Secondary Cluster: Exposed Data |
| MemberOf | Prohibited | C | 1403 | Comprehensive Categorization: Exposed Resource |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-318 | Modify Application Data (impact) |
| MemberOf | Prohibited | BS | BOSS-328 | Read Application Data (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 2 | 7PK - Environment |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 963 | SFP Secondary Cluster: Exposed Data |
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| ConfidentialityIntegrity | N/A | Read Application DataModify Application Data | N/A |
Declare Java beans "local" when possible. When a bean must be remotely accessible, make sure that sensitive information is not exposed, and ensure that the application logic performs appropriate validation of any data that might be modified by an attacker.
N/A
N/A
The following example demonstrates the weakness.
| Reference | Description |
|---|
| Ordinality | Description |
|---|
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Entity beans that expose a remote interface become part of an application's attack surface. For performance reasons, an application should rarely use remote entity beans, so there is a good chance that a remote entity bean declaration is an error.
N/A
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| 7 Pernicious Kingdoms | N/A | N/A | J2EE Misconfiguration: Unsafe Bean Declaration |
| Software Fault Patterns | SFP23 | N/A | Exposed Data |
| ID | Name |
|---|