Rule Definition
For security reasons, if a Class Variable has Public or Package visibility, it should be declared Final to avoid being updated without Class control. Also for robustness reasons in a multi-threaded environment, leaving non-protected access to non-final class variables may lead to unpredictable behavior where the state of the class/instance is changed by another thread.

Remediation
Review the Field declaration to add the relevant access type.

Violation Code Sample

Sample 1:  This sample declares a function table containing a public static field.  package org.apache.xpath.compiler;   public class FunctionTable {   public static FuncLoader m_functions; }  An attacker can replace the function table as follows:  FunctionTable.m_functions = new_table; Replacing the function table gives the attacker access to XPathContext, which is used to set the reference node for evaluating XPath expressions. Manipulating XPathContext can cause XML fields to be modified in inconsistent ways, resulting in unexpected behavior.

Fixed Code Sample

Remediation for Sample 1 :  The solution declares the FuncLoader static field final and treats it as a constant:  public static final FuncLoader m_functions; // Initialize m_functions in a static initialization block  Fields declared static and final are also safe for multithreaded use

https://wiki.sei.cmu.edu/confluence/display/java/OBJ10-J.+Do+not+use+public+static+nonfinal+fields