CWE Database
/

CWE-583

Back to CWE list

CWE-583

finalize() Method Declared Public

Variant
Incomplete

Description

The product violates secure coding principles for mobile code by declaring a finalize() method public.

A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.

Common Consequences

Scope

Confidentiality
Integrity
Availability

Impact

Alter Execution Logic, Execute Unauthorized Code or Commands, Modify Application Data

Potential Mitigations

Implementation

If you are using finalize() as it was designed, there is no reason to declare finalize() with anything other than protected access.

Applicable Platforms

Java

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now