1175
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 485 7PK - Encapsulation 700 2328
MemberOf 849 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 6 - Object Orientation (OBJ)
844 2364
MemberOf 1002 SFP Secondary Cluster: Unexpected Entry Points 888 2421
MemberOf 1139 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 05. Object Orientation (OBJ)
1133 2446
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Mobile Code: Object Hijack
The CERT Oracle Secure
Coding Standard for Java
(2011)
OBJ07-J Sensitive classes must not let
themselves be copied
Software Fault Patterns SFP28 Unexpected access points
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-453]OWASP. "OWASP , Attack Category : Mobile code: object hijack". < http://
www.owasp.org/index.php/Mobile_code:_object_hijack >.
CWE-492: Use of Inner Class Containing Sensitive Data
Weakness ID : 492
Structure : Simple
Abstraction : Variant
Description
Inner classes are translated into classes that are accessible at package scope and may expose
code that the programmer intended to keep private to attackers.
Extended Description
Inner classes quietly introduce several security concerns because of the way they are translated
into Java bytecode. In Java source code, it appears that an inner class can be declared to be
accessible only by the enclosing class, but Java bytecode has no concept of an inner class, so
the compiler must transform an inner class declaration into a peer class with package level access
to the original outer class. More insidiously, since an inner class can access private fields in its
enclosing class, once an inner class becomes a peer class in bytecode, the compiler converts
private fields accessed by the inner class into protected fields.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
CWE Version 4.14
CWE-492: Use of Inner Class Containing Sensitive Data
CWE-492: Use of Inner Class Containing Sensitive Data