CWE-500

Public Static Field Not Marked Final

High

Description

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

Potential Impact

Integrity: Modify Application Data
Confidentiality: Read Application Data

How to Fix

Architecture and Design

Clearly identify the scope for all critical data elements, including whether they should be regarded as static.

Implementation

Make any static fields private and constant. A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-500 vulnerabilities in your codebase.

Get Security Assessment