Skip to content
OpenAdvisories

Weakness (CWE)

CWE-499: Serializable Class Containing Sensitive Data

Variant Draft

The code contains a class with sensitive data, but the class does not explicitly deny serialization.

How to prevent it (2 mitigations)

  1. Implementation

    In Java, explicitly define final writeObject() to prevent serialization. This is the recommended solution. Define the writeObject() function to throw an exception explicitly denying serialization.

  2. Implementation

    Make sure to prevent serialization of your objects.

Source: MITRE CWE-499

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.7
    CVE-2024-5657

    CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure

    The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.

    Born05 CraftCMS Plugin - Two-Factor Authentication born05/craft-twofactorauthentication Packagist
  • Medium 4.9
    CVE-2022-39309

    GoCD server secret encryption/decryption key leaked to agents during material serialization

    GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoC…

    gocd gocd