The product contains a clone() method that does not call super.clone() to obtain the new object.
View on MITREAll implementations of clone() should obtain the new object by calling super.clone(). If a class does not follow this convention, a subclass's clone() method will return an object of the wrong type.
Call super.clone() within your clone() method, when obtaining a new object.
In some cases, you can eliminate the clone method altogether and use copy constructors.
No detection method information available for this CWE.
The following two classes demonstrate a bug introduced by not calling super.clone(). Because of the way Kibitzer implements clone(), FancyKibitzer's clone method will return an object of type Kibitzer instead of FancyKibitzer.
CWE-580: clone() Method Without super.clone() is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product contains a clone() method that does not call super.clone() to obtain the new object. All implementations of clone() should obtain the new object by calling super.clone(). If a class does not follow this convention, a subclass's clone() method will return an object of the wrong type.
If exploited, CWE-580 (clone() Method Without super.clone()) it can compromise Integrity and Other, leading to outcomes such as Unexpected State and Quality Degradation.
Recommended mitigations for CWE-580 include: Call super.clone() within your clone() method, when obtaining a new object. In some cases, you can eliminate the clone method altogether and use copy constructors.
CWE-580 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-580 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.