The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

If the object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability.
This weakness is sometimes known by the language-specific mechanisms that make it possible, such as mass assignment, autobinding, or object injection.

Primary

Mass Assignment
"Mass assignment" is the name of a feature in Ruby on Rails that allows simultaneous modification of multiple object attributes.

AutoBinding
The "Autobinding" term is used in frameworks such as Spring MVC and ASP.NET MVC.

PHP Object Injection
Some PHP application researchers use this term for attacking unsafe use of the unserialize() function, but it is also used for CWE-502.

Architecture and Design

Implementation

Integrity
Modify Application Data
An attacker could modify sensitive data or program variables.

Integrity
Execute Unauthorized Code or Commands

Other
Integrity
Varies by Context
Alter Execution Logic

Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
High

Implementation

If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.

Architecture and Design
Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

Implementation
Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.

Implementation
Architecture and Design
Refactoring
Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.

This function sets object attributes based on a dot-separated path.

function setValueByPath (object, path, value) {

const pathArray = path.split(".");
const attributeToSet = pathArray.pop();
let objectToModify = object;
for (const attr of pathArray) {
if (typeof objectToModify[attr] !== 'object') {
objectToModify[attr] = {};
}
objectToModify = objectToModify[attr];
}
objectToModify[attributeToSet] = value;
return object;
}

This function does not check if the attribute resolves to the object prototype. These codes can be used to add "isAdmin: true" to the object prototype.

setValueByPath({}, "__proto__.isAdmin", true)
setValueByPath({}, "constructor.prototype.isAdmin", true)

By using a denylist of dangerous attributes, this weakness can be eliminated.

function setValueByPath (object, path, value) {

const pathArray = path.split(".");
const attributeToSet = pathArray.pop();
let objectToModify = object;
for (const attr of pathArray) {

// Ignore attributes which resolve to object prototype
if (attr === "__proto__" || attr === "constructor" || attr === "prototype") {

continue;
}

if (typeof objectToModify[attr] !== "object") {

objectToModify[attr] = {};
}

objectToModify = objectToModify[attr];
}

objectToModify[attributeToSet] = value;
return object;
}

CVE-2024-3283
Application for using LLMs allows modification of a sensitive variable using mass assignment.
https://www.cve.org/CVERecord?id=CVE-2024-3283

CVE-2012-2054
Mass assignment allows modification of arbitrary attributes using modified URL.
https://www.cve.org/CVERecord?id=CVE-2012-2054

CVE-2012-2055
Source version control product allows modification of trusted key using mass assignment.
https://www.cve.org/CVERecord?id=CVE-2012-2055

CVE-2008-7310
Attackers can bypass payment step in e-commerce product.
https://www.cve.org/CVERecord?id=CVE-2008-7310

CVE-2013-1465
Use of PHP unserialize function on untrusted input allows attacker to modify application configuration.
https://www.cve.org/CVERecord?id=CVE-2013-1465

CVE-2012-3527
Use of PHP unserialize function on untrusted input in content management system might allow code execution.
https://www.cve.org/CVERecord?id=CVE-2012-3527

CVE-2012-0911
Use of PHP unserialize function on untrusted input in content management system allows code execution using a crafted cookie value.
https://www.cve.org/CVERecord?id=CVE-2012-0911

CVE-2012-0911
Content management system written in PHP allows unserialize of arbitrary objects, possibly allowing code execution.
https://www.cve.org/CVERecord?id=CVE-2012-0911

CVE-2011-4962
Content management system written in PHP allows code execution through page comments.
https://www.cve.org/CVERecord?id=CVE-2011-4962

CVE-2009-4137
Use of PHP unserialize function on cookie value allows remote code execution or upload of arbitrary files.
https://www.cve.org/CVERecord?id=CVE-2009-4137

CVE-2007-5741
Content management system written in Python interprets untrusted data as pickles, allowing code execution.
https://www.cve.org/CVERecord?id=CVE-2007-5741

CVE-2011-2520
Python script allows local users to execute code via pickled data.
https://www.cve.org/CVERecord?id=CVE-2011-2520

CVE-2005-2875
Python script allows remote attackers to execute arbitrary code using pickled objects.
https://www.cve.org/CVERecord?id=CVE-2005-2875

CVE-2013-0277
Ruby on Rails allows deserialization of untrusted YAML to execute arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2013-0277

CVE-2011-2894
Spring framework allows deserialization of objects from untrusted sources to execute arbitrary code.
https://www.cve.org/CVERecord?id=CVE-2011-2894

CVE-2012-1833
Grails allows binding of arbitrary parameters to modify arbitrary object properties.
https://www.cve.org/CVERecord?id=CVE-2012-1833

CVE-2010-3258
Incorrect deserialization in web browser allows escaping the sandbox.
https://www.cve.org/CVERecord?id=CVE-2010-3258

CVE-2008-1013
Media library allows deserialization of objects by untrusted Java applets, leading to arbitrary code execution.
https://www.cve.org/CVERecord?id=CVE-2008-1013

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more narrowly scoped to object modification, and is not necessarily used for deserialization.

CWE Content Team
MITRE
2013-01-26
2.4
2013-02-21

CWE Content Team
MITRE
2013-07-17
updated References

CWE Content Team
MITRE
2017-05-03
updated Potential_Mitigations

CWE Content Team
MITRE
2017-11-08
updated References

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Alternate_Terms, Potential_Mitigations

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Observed_Examples

CWE Content Team
MITRE
2023-04-27
updated Detection_Factors, References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2024-07-16
4.15
2024-07-16
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships

Dan Amodio, Dave Wichers
Aspect Security
2013-01-26
Suggested adding mass assignment, provided references, and clarified relationship with AutoBinding.