Variant weakness
Draft
CWE-499: Serializable Class Containing Sensitive Data
The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
2
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
High
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
Serializable classes are effectively open classes since data cannot be hidden in them. Classes that do not explicitly deny serialization can be serialized by any other class, which can then in turn use the data stored inside it.