Variant weakness
Draft
CWE-498: Cloneable Class Containing Sensitive Information
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Medium
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
Cloneable classes are effectively open classes, since data cannot be hidden in them. Classes that do not explicitly deny cloning can be cloned by any other class without running the constructor.
Common consequences
What can happen when CWE-498 is exploited.
Bypass Protection Mechanism
Affects: Access Control
A class that can be cloned can be produced without executing the constructor. This is dangerous since the constructor may perform security-related checks. By allowing the object to be cloned, those checks may be bypassed.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Implementation
Applies to
Languages
Object-Oriented
C++
Java
C#