1197
The code contains a class with sensitive data, but the class is cloneable. The data can then be
accessed by cloning the class.
Extended Description
Cloneable classes are effectively open classes, since data cannot be hidden in them. Classes that
do not explicitly deny cloning can be cloned by any other class without running the constructor.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
CanPrecede 200 Exposure of Sensitive Information to an Unauthorized Actor 504
Applicable Platforms
Language : C++ (Prevalence = Undetermined)
Language : Java (Prevalence = Undetermined)
Language : C# (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
A class that can be cloned can be produced without
executing the constructor. This is dangerous since the
constructor may perform security-related checks. By
allowing the object to be cloned, those checks may be
bypassed.
Potential Mitigations
Phase: Implementation
If you do make your classes clonable, ensure that your clone method is final and throw
super.clone().
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: Java (Bad)
public class CloneClient {
public CloneClient() //throws
java.lang.CloneNotSupportedException {
Teacher t1 = new Teacher("guddu","22,nagar road");
//...
// Do some stuff to remove the teacher.
Teacher t2 = (Teacher)t1.clone();
System.out.println(t2.name);
}
public static void main(String args[]) {
new CloneClient();
CWE Version 4.14
CWE-499: Serializable Class Containing Sensitive Data
CWE-499: Serializable Class Containing Sensitive Data