Variant weakness
Draft
CWE-500: Public Static Field Not Marked Final
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
High
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
Public static variables can be read without an accessor and changed without a mutator by any classes in the application.
Background
When a field is declared public but not final, the field can be read and written to by arbitrary Java code.
Common consequences
What can happen when CWE-500 is exploited.
Modify Application Data
Affects: Integrity
The object could potentially be tampered with.
Read Application Data
Affects: Confidentiality
The object could potentially allow the object to be read.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Implementation
Applies to
Languages
C++
Java