Skip to content
OpenAdvisories

Weakness (CWE)

CWE-495: Private Data Structure Returned From A Public Method

Variant Draft

The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.

How to prevent it (3 mitigations)

  1. Implementation

    Declare the method private.

  2. Implementation

    Clone the member data and keep an unmodified version of the data private to the object.

  3. Implementation

    Use public setter methods that govern how a private member can be modified.

Source: MITRE CWE-495

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium —
    GHSA-gcjh-h69q-9w9g

    cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

    The function `ext.NativeTypes(ParseStructTag("json"))` does not honour the `encoding/json` skip directive `json:"-"`. Fields tagged `json:"-"` are registered in the CEL type system under the literal name `"-"` and are readable from any user-submitted CEL expr…

    github.com/google/cel-go Go
  • Medium 6.5
    CVE-2025-29868

    Apache Answer: Using externally referenced images can leak user privacy.

    Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private …

    Apache Software Foundation Apache Answer github.com/apache/answer Go