Skip to content
OpenAdvisories

Weakness (CWE)

CWE-499: Serializable Class Containing Sensitive Data

Variant Draft

The code contains a class with sensitive data, but the class does not explicitly deny serialization.

How to prevent it (2 mitigations)

  1. Implementation

    In Java, explicitly define final writeObject() to prevent serialization. This is the recommended solution. Define the writeObject() function to throw an exception explicitly denying serialization.

  2. Implementation

    Make sure to prevent serialization of your objects.

Source: MITRE CWE-499

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.