The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
In Java, explicitly define final writeObject() to prevent serialization. This is the recommended solution. Define the writeObject() function to throw an exception explicitly denying serialization.
Make sure to prevent serialization of your objects.
Our security experts can help you identify and remediate CWE-499 vulnerabilities in your codebase.
Get Security Assessment