CWE 500

Public Static Field Not Marked Final

Weakness ID: 500 (Weakness Variant)

Status: Draft

Description

Description Summary

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

Time of Introduction

Applicable Platforms

Languages

C++

Java

Common Consequences

Scope	Effect
Integrity	The object could potentially be tampered with.
Confidentiality	The object could potentially allow the object to be read.

Likelihood of Exploit

High

Demonstrative Examples

Example 1

This is a static variable that can be read without an accessor and changed without a mutator.

(Bad Code)

Example Language: C++

public:

static string str = "My String";

(Bad Code)

Example Language: Java

static public String str = "My String";

Potential Mitigations

Phase: Architecture and Design

Clearly identify the scope for all critical data elements, including whether they should be regarded as static.

Phase: Implementation

Make any static fields private and final.

Background Details

When a field is declared public but not final, the field can be read and written to by arbitrary Java code.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Variant	493	Critical Public Variable Without Final Modifier	Development Concepts (primary)699 Research Concepts (primary)1000

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
CLASP			Overflow of static internal buffer

White Box Definitions

A weakness where code path has a statement that defines a public field that is static and non-final

Content History

Submissions
Submission Date	Submitter	Organization	Source
	CLASP		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time of Introduction
2008-08-01		KDM Analytics	External
2008-08-01	added/updated white box definitions
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Applicable Platforms, Common Consequences, Relationships, Other Notes, Taxonomy Mappings
2008-11-05	CWE Content Team	MITRE	Internal
2008-11-05	Significant clarification of this entry, and improved examples.
2008-11-24	CWE Content Team	MITRE	Internal
2008-11-24	updated Background Details, Demonstrative Examples, Description, Name, Other Notes, Potential Mitigations
2009-05-27	CWE Content Team	MITRE	Internal
2009-05-27	updated Relationships
Previous Entry Names
Change Date	Previous Entry Name
2008-04-11	Overflow of Static Internal Buffer

2008-11-24	Static Field Not Marked Final