1609
ExitError("Invalid username or password");
}
// if the username and password in the input parameters are equal to
// the username and password of this account class then authorize access
if (strcmp(this->username, username) ||
strcmp(this->password, password))
return 0;
// otherwise do not authorize access
else
return 1;
}
char username[MAX_USERNAME_LENGTH+1];
char password[MAX_PASSWORD_LENGTH+1];
};
However, the member variables username and password are declared public and therefore will
allow access and changes to the member variables to anyone with access to the object. These
member variables should be declared private as shown below to prevent unauthorized access and
changes.
Example Language: C++ (Good)
class UserAccount
{
public:
...
private:
char username[MAX_USERNAME_LENGTH+1];
char password[MAX_PASSWORD_LENGTH+1];
};
Observed Examples
Reference Description
CVE-2010-3860 variables declared public allow remote read of system properties such as user
name and home directory.
https://www.cve.org/CVERecord?id=CVE-2010-3860
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1130 CISQ Quality Measures (2016) - Maintainability 1128 2441
MemberOf 1139 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 05. Object Orientation (OBJ)
1133 2446
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to protect stored data from
modification
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ01-J Declare data members as private and
provide accessible wrapper methods
Software Fault Patterns SFP28 Unexpected access points
CWE Version 4.14
CWE-767: Access to Critical Private Variable via Public Method
CWE-767: Access to Critical Private Variable via Public Method