1182
Nature Type ID Name Page
MemberOf 1139 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 05. Object Orientation (OBJ)
1133 2446
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Other
Mobile code, in this case a Java Applet, is code that is transmitted across a network and
executed on a remote machine. Because mobile code developers have little if any control of the
environment in which their code will execute, special security concerns become relevant. One of
the biggest environmental threats results from the risk that the mobile code will run side-by-side
with other, potentially malicious, mobile code. Because all of the popular web browsers execute
code from multiple sources together in the same JVM, many of the security guidelines for mobile
code are focused on preventing manipulation of your objects' state and behavior by adversaries
who have access to the same virtual machine where your program is running.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Mobile Code: Use of Inner Class
CLASP Publicizing of private data when using
inner classes
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ08-J Do not expose private members of an
outer class from within a nested class
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-493: Critical Public Variable Without Final Modifier
Weakness ID : 493
Structure : Simple
Abstraction : Variant
Description
The product has a critical public variable that is not final, which allows the variable to be modified to
contain unexpected values.
Extended Description
If a field is non-final and public, it can be changed once the value is set by any function that has
access to the class which contains the field. This could lead to a vulnerability if other parts of the
program make assumptions about the contents of that field.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-493: Critical Public Variable Without Final Modifier
CWE-493: Critical Public Variable Without Final Modifier