CWE-498

Cloneable Class Containing Sensitive Information
AI Translation Available

The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.

Status
draft
Abstraction
variant
Likelihood
medium
C# C++ Java Object-Oriented

Cloneable classes are effectively open classes, since data cannot be hidden in them. Classes that do not explicitly deny cloning can be cloned by any other class without running the constructor.

Common Consequences

access control
Impacts
bypass protection mechanism

Detection Methods

automated static analysis

Potential Mitigations

Phases:
implementation
Descriptions:
• If you do make your classes clonable, ensure that your clone method is final and throw super.clone().