A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
View on MITREProtect mutable objects by making them private. Restrict access to the getter and setter as well.
No detection method information available for this CWE.
Here, an array (which is inherently mutable) is labeled public static final.
CWE-607: Public Static Final Field References Mutable Object is a Common Weakness Enumeration (CWE) entry maintained by MITRE. A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
If exploited, CWE-607 (Public Static Final Field References Mutable Object) it can compromise Integrity, leading to outcomes such as Modify Application Data.
Recommended mitigations for CWE-607 include: Protect mutable objects by making them private. Restrict access to the getter and setter as well.
CWE-607 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-607 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.