CWE-766 Critical Data Element Declared Public

The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.

• Integrity, Confidentiality: Read Application Data, Modify Application Data — Making a critical variable public allows anyone with access to the object in which the variable is contained to alter or read the value. • Other: Reduce Maintainability — This issue makes it more difficult to maintain the product, which indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities.

• [Implementation] Data should be private, static, and final whenever possible. This will assure that your code is protected by instantiating early, preventing access, and preventing tampering.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2010-3860: variables declared public allow remote read of system properties such as user name and home directory.