Filename: UserFactory.java
Line: 43
CWE: 502 (Deserialization of Untrusted Data ('Encapsulation'))
The serialized-object data stream used in the call to java.io.ObjectInput.readObject() appears to have been constructed with untrusted data. Attacker manipulation of this stream has the ability to cause the creation of objects of arbitrary Serializable types. Paired with a weakness in another class's constructor, this could result in a denial of service, code execution, or data corruption vulnerability. readObject() was called on the in object, which contains tainted data. The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies. Avoid passing untrusted data; if the data is untrusted, consider switching to a safer serialization scheme such as JSON. References: CWE
Filename: UserFactory.java
Line: 43
CWE: 502 (Deserialization of Untrusted Data ('Encapsulation'))
The serialized-object data stream used in the call to java.io.ObjectInput.readObject() appears to have been constructed with untrusted data. Attacker manipulation of this stream has the ability to cause the creation of objects of arbitrary Serializable types. Paired with a weakness in another class's constructor, this could result in a denial of service, code execution, or data corruption vulnerability. readObject() was called on the in object, which contains tainted data. The tainted data originated from an earlier call to javax.servlet.http.HttpServletRequest.getCookies. Avoid passing untrusted data; if the data is untrusted, consider switching to a safer serialization scheme such as JSON. References: CWE