933
Nature Type ID Name Page
MemberOf 964 SFP Secondary Cluster: Exposure Temporary File 888 2402
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Guessed or visible temporary file
CERT C Secure Coding FIO15-C Ensure that file operations are
performed in a secure directory
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-382: J2EE Bad Practices: Use of System.exit()
Weakness ID : 382
Structure : Simple
Abstraction : Variant
Description
A J2EE application uses System.exit(), which also shuts down its container.
Extended Description
It is never a good idea for a web application to attempt to shut down the application container.
Access to a function that can shut down the application is an avenue for Denial of Service (DoS)
attacks.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 705 Incorrect Control Flow Scoping 1542
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Crash, Exit, or Restart
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
CWE Version 4.14
CWE-382: J2EE Bad Practices: Use of System.exit()
CWE-382: J2EE Bad Practices: Use of System.exit()