CWE-579

J2EE Bad Practices: Non-serializable Object Stored in Session

Medium

Description

The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

Potential Impact

Other: Quality Degradation

How to Fix

Implementation

In order for session replication to work, the values the product stores as attributes in the session must implement the Serializable interface.

Detection Methods

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-579 vulnerabilities in your codebase.

Get Security Assessment