CWE-608
Struts: Non-private Field in ActionForm Class
AI Translation Available
An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
Status
draft
Abstraction
variant
Affected Platforms
Java
Technical Details
AI Translation
Common Consequences
integrity
confidentiality
Impacts
modify application data
read application data
Detection Methods
automated static analysis
Potential Mitigations
Phases:
implementation
Descriptions:
•
Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.