CWE-1108 — Vulnerability Class 2

CWE-1108 represents a structural weakness where software architecture excessively depends on global variables for state management rather than encapsulating data within local scopes. This design flaw typically enables exploitation by allowing attackers to manipulate shared state across unrelated code modules, potentially bypassing security checks or causing unintended side effects through race conditions and unauthorized data modification. Because global variables lack strict access controls, malicious actors can inject harmful values that persist throughout the application’s lifecycle, compromising integrity and confidentiality. To mitigate this risk, developers should adopt modular programming practices, passing data explicitly through function parameters and return values. Implementing strict encapsulation and minimizing variable scope ensures that state changes are localized, predictable, and easier to audit, thereby reducing the attack surface and enhancing overall system resilience against state-based vulnerabilities.