CWE-608: Struts: Non-private Field in ActionForm Class

Variant Draft Simple

CWE版本: 4.18

更新日期: 2025-09-09

弱点描述

An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

常见后果

影响范围: Integrity Confidentiality

技术影响: Modify Application Data Read Application Data

潜在缓解措施

阶段: Implementation

描述: Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.

引入模式

阶段	说明
Implementation	-

适用平台

编程语言

Java (Undetermined)

分类映射

分类名称	条目ID	条目名称	映射适配度
Software Fault Patterns	SFP28	Unexpected access points	-

关键信息

CWE ID: CWE-608

抽象级别: Variant

结构: Simple

状态: Draft