1200
Example Language: Java (Bad)
class PatientRecord {
private String name;
private String socialSecurityNum;
public Patient(String name,String ssn) {
this.SetName(name);
this.SetSocialSecurityNumber(ssn);
}
}
This object does not explicitly deny serialization, allowing an attacker to serialize an instance of this
object and gain a patient's name and Social Security number even though those fields are private.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 858 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 15 - Serialization (SER)
844 2368
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1148 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 14. Serialization (SER)
1133 2451
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Information leak through serialization
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER03-J Do not serialize unencrypted, sensitive
data
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER05-J Do not serialize instances of inner
classes
Software Fault Patterns SFP23 Exposed Data
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-500: Public Static Field Not Marked Final
Weakness ID : 500
Structure : Simple
Abstraction : Variant
Description
An object contains a public static field that is not marked final, which might allow it to be modified in
unexpected ways.
Extended Description
Public static variables can be read without an accessor and changed without a mutator by any
classes in the application.
CWE Version 4.14
CWE-500: Public Static Field Not Marked Final
CWE-500: Public Static Field Not Marked Final