About GET A DEMO

Backslash Vulnerability Database

Struts: Non-private Field in ActionForm Class

Struts: Non-private Field in ActionForm Class

CWE-608

Short description

An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

Best practices to prevent this CWE

Phase: Implementation

Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.

Prioritize and Uncover Reachable Vulnerabilities in Your Application Code

Identify externally reachable data flows and vulnerabilities for effective risk mitigation

© 2023 Backslash. 28 HaArba'a St., Tel-Aviv Privacy Policy | Terms of Use