Détail du CWE-608

An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

Modes d'introduction

Implementation

Plateformes applicables

Langue

Name: Java (Undetermined)

Conséquences courantes

Mesures d’atténuation potentielles

Phases : Implementation
Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Soumission

Modifications