logo

CWE-499 - Serializable Class Containing Sensitive Data

CWE-499 High

  • Abstraction:
  • Variant
  • Structure:
  • Simple
  • Status:
  • Draft
Weakness Name

Serializable Class Containing Sensitive Data

Description

The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

Serializable classes are effectively open classes since data cannot be hidden in them. Classes that do not explicitly deny serialization can be serialized by any other class, which can then in turn use the data stored inside it.

Common Consequences

Scope: Confidentiality

Impact: Read Application Data

Notes: an attacker can write out the class to a byte stream, then extract the important data from it.

Related Weaknesses
  • Release Date:
  • 2006-07-19
  • Latest Modification Date:
  • 2023-06-29

Free security scan for your website