1168
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 664 Improper Control of a Resource Through its Lifetime 1454
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Any data in a Java package can be accessed outside of
the Java framework if the package is distributed.
Integrity Modify Application Data
The data in a Java class can be modified by anyone
outside of the Java framework if the packages is
distributed.
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Data should be private static and final whenever possible. This will assure that your code is
protected by instantiating early, preventing access and tampering.
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: Java (Bad)
package math;
public class Lebesgue implements Integration{
public final Static String youAreHidingThisFunction(functionToIntegrate){
return ...;
}
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 850 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 7 - Methods (MET)
844 2364
MemberOf 966 SFP Secondary Cluster: Other Exposures 888 2403
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
CWE Version 4.14
CWE-488: Exposure of Data Element to Wrong Session
CWE-488: Exposure of Data Element to Wrong Session