1361
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP23 Exposed Data
CWE-608: Struts: Non-private Field in ActionForm Class
Weakness ID : 608
Structure : Simple
Abstraction : Variant
Description
An ActionForm class contains a field that has not been declared private, which can be accessed
without using a setter or getter.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Modify Application Data
Read Application Data
Potential Mitigations
Phase: Implementation
Make all fields private. Use getter to get the value of the field. Setter should be used only by the
framework; setting an action form field from other actions is bad practice and should be avoided.
Demonstrative Examples
Example 1:
In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean
that will maintain user input data from a registration webpage for a online business site. The
CWE Version 4.14
CWE-609: Double-Checked Locking
CWE-609: Double-Checked Locking