CWE-491
Public cloneable() Method Without Final ('Object Hijack')
A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
Impactr finds and proves whether CWE-491 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.