CWE-487

Reliance on Package-level Scope
AI Translation Available

Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.

Status
incomplete
Abstraction
base
Likelihood
medium
Java

The purpose of package scope is to prevent accidental access by other parts of a program. This is an ease-of-software-development feature but not a security feature.

Common Consequences

confidentiality integrity
Impacts
read application data modify application data

Detection Methods

automated static analysis

Potential Mitigations

Phases:
architecture and design implementation
Descriptions:
• Data should be private static and final whenever possible. This will assure that your code is protected by instantiating early, preventing access and tampering.