The software declares a critical variable or field to be public
when intended security policy requires it to be private.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
C++
C#
Java
Common Consequences
Scope
Effect
Integrity
Confidentiality
Making a critical variable public allows anyone with access to the
object in which the variable is contained to alter or read the value.
Likelihood of Exploit
Low to Medium
Demonstrative Examples
Example 1
The following example declares a critical variable public, making it
accessible to anyone with access to the object in which it is
contained.
(Bad Code)
C++
public: char* password;
Instead, the critical data should be declared private.
(Good Code)
C++
private: char* password;
Even though this example declares the password to be private, there
are other possible issues with this implementation, such as the
possibility of recovering the password from process memory
(CWE-257).
Potential Mitigations
Phase
Description
Implementation
Data should be private, static, and final whenever possible. This will
assure that your code is protected by instantiating early, preventing
access, and preventing tampering.
Description
