CWE-499

Serializable Class Containing Sensitive Data
AI Translation Available

The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

Status
draft
Abstraction
variant
Likelihood
high
Java

Serializable classes are effectively open classes since data cannot be hidden in them. Classes that do not explicitly deny serialization can be serialized by any other class, which can then in turn use the data stored inside it.

Common Consequences

confidentiality
Impacts
read application data

Detection Methods

automated static analysis

Potential Mitigations

Phases:
implementation
Descriptions:
• Make sure to prevent serialization of your objects.
• In Java, explicitly define final writeObject() to prevent serialization. This is the recommended solution. Define the writeObject() function to throw an exception explicitly denying serialization.