CWE-8 is about Java enterprise beans. When an application exposes a remote interface for an entity bean, it may also expose the methods that get and set the bean's data. Anyone who can reach that interface can use those methods.
MITRE says those methods could be used to read sensitive information, or to change data in ways the application does not expect, which can lead to other vulnerabilities. Entity beans are an older part of the Java enterprise stack, so you will mostly meet this in long-lived systems.
How it happens
A bean can offer a local interface, which only code in the same container can call, or a remote interface, which can be called across the network. Declaring the bean remote is a design choice that widens its audience. If the bean is a data holder with plain accessors, a remote declaration turns each accessor into a network entry point.
This tends to happen when a bean was built for convenience, or copied from an example, and nobody asked who needs to call it from outside.
What an attacker gains
MITRE lists confidentiality and integrity impact: reading application data and modifying application data. The attacker does not need to break anything. They call methods the application published.
How to find it
Inventory the beans in your deployment descriptors and annotations. For each one, note whether it has a remote interface and whether any remote client genuinely needs it. A data bean with remote accessors and no stated consumer deserves a closer look.
How to fix it
- Prefer local interfaces for beans that only serve code in the same application.
- If remote access is needed, expose a narrow service method, not raw getters and setters.
- Put access control on every remotely callable method.
- Retire entity beans where the platform allows, in favour of a current persistence approach.
Quick check
Why are getters and setters the concern?
They give direct read and write access to stored data. Exposed remotely, they bypass the validation a service method would normally apply.
