CWE-487
Reliance on Package-level Scope
Description
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
The purpose of package scope is to prevent accidental access by other parts of a program. This is an ease-of-software-development feature but not a security feature.
Parent Weaknesses (ChildOf)
Common Consequences
Scope
Impact
Read Application Data
Scope
Impact
Modify Application Data
Potential Mitigations
Data should be private static and final whenever possible. This will assure that your code is protected by instantiating early, preventing access and tampering.
Applicable Platforms
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now