CWE-495 - Private Data Structure Returned From A Public Method

Read Time:31 Second

Description

The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.

Modes of Introduction:

– Implementation

Related Weaknesses

CWE-664

Consequences

Integrity: Modify Application Data

The contents of the data structure can be modified from outside the intended scope.

Potential Mitigations

Phase: Implementation

Description:

Declare the method private.

Phase: Implementation

Description:

Clone the member data and keep an unmodified version of the data private to the object.

Phase: Implementation

Description:

Use public setter methods that govern how a private member can be modified.

CVE References

InCWE- 495, Private Data Structure Returned From A Public Method

The Most Dangerous Vulnerabilities in Apache Tomcat and How to Protect Against Them

Apache Tomcat is an open-source web server and servlet container that is widely used in enterprise environments to run Java...

rocco

February 19, 2023February 19, 2023

ZDI-CAN-18333: A Critical Zero-Day Vulnerability in Microsoft Windows

Zero-day vulnerabilities are a serious threat to cybersecurity, as they can be exploited by malicious actors to gain unauthorized access...

rocco

February 19, 2023February 19, 2023

CWE-669 – Incorrect Resource Transfer Between Spheres

Description The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere,...

rocco

May 26, 2022