1611
The following example declares a critical variable to be private, and then allows the variable to be
modified by public methods.
Example Language: C++ (Bad)
private: float price;
public: void changePrice(float newPrice) {
price = newPrice;
}
Example 2:
The following example could be used to implement a user forum where a single user (UID) can
switch between multiple profiles (PID).
Example Language: Java (Bad)
public class Client {
private int UID;
public int PID;
private String userName;
public Client(String userName){
PID = getDefaultProfileID();
UID = mapUserNametoUID( userName );
this.userName = userName;
}
public void setPID(int ID) {
UID = ID;
}
}
The programmer implemented setPID with the intention of modifying the PID variable, but due to
a typo. accidentally specified the critical variable UID instead. If the program allows profile IDs to
be between 1 and 10, but a UID of 1 means the user is treated as an admin, then a user could gain
administrative privileges as a result of this typo.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1184 SEI CERT Perl Coding Standard - Guidelines 06.
Object-Oriented Programming (OOP)
1178 2467
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Maintenance
This entry is closely associated with access control for public methods. If the public methods
are restricted with proper access controls, then the information in the private variable will not
be exposed to unexpected parties. There may be chaining or composite relationships between
improper access controls and this weakness.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to protect stored data from
modification
Software Fault Patterns SFP23 Exposed Data
CWE Version 4.14
CWE-768: Incorrect Short Circuit Evaluation
CWE-768: Incorrect Short Circuit Evaluation