CWE-8 J2EE误配置：实体Bean远程声明

J2EE Misconfiguration: Entity Bean Declared Remote

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 668 cwe_View_ID: 1000 cwe_Ordinal: Primary

常见的影响

可能的缓解方案

Implementation

策略:

Declare Java beans "local" when possible. When a bean must be remotely accessible, make sure that sensitive information is not exposed, and ensure that the application logic performs appropriate validation of any data that might be modified by an attacker.

示例代码

例

The following example demonstrates the weakness.

bad XML

Notes

分类映射