Variant weakness
Draft
CWE-580: clone() Method Without super.clone()
The product contains a clone() method that does not call super.clone() to obtain the new object.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
All implementations of clone() should obtain the new object by calling super.clone(). If a class does not follow this convention, a subclass's clone() method will return an object of the wrong type.
Common consequences
What can happen when CWE-580 is exploited.
Unexpected State, Quality Degradation
Affects: Integrity, Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Implementation
Applies to
Languages
Java
How to prevent it
Practical mitigations for CWE-580, grouped by where in the lifecycle they apply.
Implementation
Call super.clone() within your clone() method, when obtaining a new object.