CWE-495 — Private Data Structure Returned From A Public Method
CWE-495: Private Data Structure Returned From A Public Method
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
Common consequences
- Integrity: Modify Application Data
Mitigations
Implementation — Declare the method private.
Implementation — Clone the member data and keep an unmodified version of the data private to the object.
Implementation — Use public setter methods that govern how a private member can be modified.
References
- CWE page: https://cwe.mitre.org/data/definitions/495.html
- CWE list: https://cwe.mitre.org/data/index.html