CWE-495: Private Data Structure Returned From A Public Method
Description
The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Integrity
Modify Application Data
The contents of the data structure can be modified from outside the intended scope.
Potential mitigations
- Implementation
Declare the method private.
- Implementation
Clone the member data and keep an unmodified version of the data private to the object.
- Implementation
Use public setter methods that govern how a private member can be modified.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.