An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

Primary

Implementation

Integrity
Confidentiality
Modify Application Data
Read Application Data

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Implementation
Make all fields private. Use getter to get the value of the field. Setter should be used only by the framework; setting an action form field from other actions is bad practice and should be avoided.

In the following Java example the class RegistrationForm is a Struts framework ActionForm Bean that will maintain user input data from a registration webpage for a online business site. The user will enter registration data and through the Struts framework the RegistrationForm bean will maintain the user data.

public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {

// variables for registration formpublic String name;public String email;...
public RegistrationForm() {super();}public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {...}...
}

However, within the RegistrationForm the member variables for the registration form input data are declared public not private. All member variables within a Struts framework ActionForm class must be declared private to prevent the member variables from being modified without using the getter and setter methods. The following example shows the member variables being declared private and getter and setter methods declared for accessing the member variables.

public class RegistrationForm extends org.apache.struts.validator.ValidatorForm {

// private variables for registration formprivate String name;private String email;...
public RegistrationForm() {super();}
public ActionErrors validate(ActionMapping mapping, HttpServletRequest request) {...}

// getter and setter methods for private variables...}

SFP28
Unexpected access points

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Anonymous Tool Vendor (under NDA)
2007-05-07
Draft 6
2007-05-07

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2010-06-21
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Causal_Nature, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Detection_Factors