1333
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1076 Insufficient Adherence to Expected Conventions 1916
Weakness Ordinalities
Indirect :
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Data represented by unserializable objects can be
corrupted.
Availability DoS: Crash, Exit, or Restart
Non-serializability of objects can lead to system crash.
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
All objects that become part of session and application scope must implement the
java.io.Serializable interface to ensure serializability of containing objects.
Demonstrative Examples
Example 1:
In the following Java example, a Customer Entity JavaBean provides access to customer
information in a database for a business application. The Customer Entity JavaBean is used as a
session scoped object to return customer information to a Session EJB.
Example Language: Java (Bad)
@Entity
public class Customer {
private String id;
private String firstName;
private String lastName;
private Address address;
public Customer() {
}
public Customer(String id, String firstName, String lastName) {...}
@Id
public String getCustomerId() {...}
public void setCustomerId(String id) {...}
public String getFirstName() {...}
public void setFirstName(String firstName) {...}
public String getLastName() {...}
public void setLastName(String lastName) {...}
@OneToOne()
public Address getAddress() {...}
CWE Version 4.14
CWE-595: Comparison of Object References Instead of Object Contents
CWE-595: Comparison of Object References Instead of Object Contents