1169
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Relying on package-level scope
The CERT Oracle Secure
Coding Standard for Java
(2011)
MET04-J Do not increase the accessibility of
overridden or hidden methods
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-488: Exposure of Data Element to Wrong Session
Weakness ID : 488
Structure : Simple
Abstraction : Base
Description
The product does not sufficiently enforce boundaries between the states of different sessions,
causing data to be provided to, or used by, the wrong session.
Extended Description
Data can "bleed" from one session to another through member variables of singleton objects, such
as Servlets, and objects from a shared pool.
In the case of Servlets, developers sometimes do not understand that, unless a Servlet implements
the SingleThreadModel interface, the Servlet is a singleton; there is only one instance of the
Servlet, and that single instance is used and re-used to handle multiple requests that are
processed simultaneously by different threads. A common result is that developers use Servlet
member fields in such a way that one user may inadvertently see another user's data. In other
words, storing user data in Servlet member fields introduces a data access race condition.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
CanFollow 567 Unsynchronized Access to Shared Data in a Multithreaded
Context