923
Nature Type ID Name Page
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1139 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 05. Object Orientation (OBJ)
1133 2446
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Passing mutable objects to an
untrusted method
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ04-J Provide mutable classes with copy
functionality to safely allow passing
instances to untrusted code
Software Fault Patterns SFP23 Exposed Data
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-374]Tony Sintes. "Does Java pass by reference or pass by value?". JavaWorld.com. 2000
May 6. < https://web.archive.org/web/20000619025001/https://www.javaworld.com/javaworld/
javaqa/2000-05/03-qa-0526-pass.html >.2023-04-07.
[REF-375]Herbert Schildt. "Java: The Complete Reference, J2SE 5th Edition".
CWE-375: Returning a Mutable Object to an Untrusted Caller
Weakness ID : 375
Structure : Simple
Abstraction : Base
Description
Sending non-cloned mutable data as a return value may result in that data being altered or deleted
by the calling function.
Extended Description
In situations where functions return references to mutable data, it is possible that the external
code which called the function may make changes to the data sent. If this data was not previously
cloned, the class will then be using modified data which may violate assumptions about its internal
state.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 371 State Issues 2321
CWE Version 4.14
CWE-375: Returning a Mutable Object to an Untrusted Caller
CWE-375: Returning a Mutable Object to an Untrusted Caller