Back to CWE list
CWE-495
Private Data Structure Returned From A Public Method
Variant
Draft
Description
The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
Parent Weaknesses (ChildOf)
Common Consequences
Scope
Integrity
Impact
Modify Application Data
Potential Mitigations
Implementation
Declare the method private.
Implementation
Clone the member data and keep an unmodified version of the data private to the object.
Implementation
Use public setter methods that govern how a private member can be modified.
Applicable Platforms
Object-Oriented
C
C++
Java
C#
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now