This vulnerability occurs when an array is declared as public, final, and static, which does not protect the data inside the array from being altered.
While the `final` keyword ensures the array reference itself cannot point to a new object, it does not lock the contents of the array. The array elements remain fully mutable, meaning their values can be changed, added, or removed. Because the array is also declared `public`, any part of the code—including potentially untrusted or malicious components—can directly access and modify the array's data. This combination of public exposure with insufficient data protection typically represents a security flaw or design oversight that should be corrected.
Impact: Modify Application Data
java