Critical Data Element Declared Public

Opis

The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.

This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it easier to introduce vulnerabilities.

Skutki

• Integrity, Confidentiality

  Read Application Data; Modify Application Data

  Making a critical variable public allows anyone with access to the object in which the variable is contained to alter or read the value.

• Other

  Reduce Maintainability

Zapobieganie

• Implementation

  Data should be private, static, and final whenever possible. This will assure that your code is protected by instantiating early, preventing access, and preventing tampering.

Przykłady podatności

• CVE-2010-3860 variables declared public allow remote read of system properties such as user name and home directory.

Słabość nadrzędna

• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-1061 Insufficient Encapsulation

Kiedy powstaje

• Implementation

Dotyczy

C++, C#, Java

Źródła

1. Automated Source Code Maintainability Measure (ASCMM) — Object Management Group (OMG), ASCMM-MNT-15, 2016