CWEweakness

CWE-491 Public cloneable() Method Without Final

Official page ↗
Alternate terms
Object Hijack
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Java
CWE version
5.0

Description

A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

Common consequences

• Integrity, Other: Unexpected State, Varies by Context

Potential mitigations

• [Implementation] Make the cloneable() method final.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Related

Child of · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

Referenced by CVE · weakness (4)

  • CVE-2025-63685 Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. vulnerability
  • CVE-2025-60425 Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is… vulnerability
  • CVE-2025-55622 Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings. vulnerability
  • CVE-2024-39069 An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack. vulnerability