Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
In situations where functions return references to mutable data, it is possible that the external code which called the function may make changes to the data sent. If this data was not previously cloned, the class will then be using modified data which may violate assumptions about its internal state.

Primary

Implementation

Medium

Access Control
Integrity
Modify Memory
Potentially data could be tampered with by another function which should not have been tampered with.

Implementation
Declare returned data which should not be altered as constant or immutable.

Implementation
Clone all mutable data before returning references to it. This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.

This class has a private list of patients, but provides a way to see the list :

public class ClinicalTrial {private PatientClass[] patientList = new PatientClass[50];public getPatients(...){return patientList;}}

While this code only means to allow reading of the patient list, the getPatients() method returns a reference to the class's original patient list instead of a reference to a copy of the list. Any caller of this method can arbitrarily modify the contents of the patient list even though it is a private member of the class.

Mutable object returned

OBJ04-J
Provide mutable classes with copy functionality to safely allow passing instances to untrusted code

OBJ05-J
Defensively copy private mutable class members before returning their references

EXP34-PL
Do not modify $_ in list or sorting functions
Imprecise

SFP23
Exposed Data

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CLASP
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2010-09-27
updated Name, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-10-30
updated Demonstrative_Examples

CWE Content Team
MITRE
2014-06-23
updated Description, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Taxonomy_Mappings

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated References

CWE Content Team
MITRE
2021-03-15
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities

Passing Mutable Objects to an Untrusted Method