1000
Reference Description
https://www.cve.org/CVERecord?id=CVE-1999-1363
CVE-2001-1340 Product supports only one connection and does not disconnect a user who
does not provide credentials.
https://www.cve.org/CVERecord?id=CVE-2001-1340
CVE-2002-0406 Large number of connections without providing credentials allows connection
exhaustion.
https://www.cve.org/CVERecord?id=CVE-2002-0406
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 730 OWASP Top Ten 2004 Category A9 - Denial of Service 711 2339
MemberOf 855 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 12 - Thread Pools (TPS)
844 2367
MemberOf 977 SFP Secondary Cluster: Design 888 2407
MemberOf 1145 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 11. Thread Pools (TPS)
1133 2450
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insufficient Resource Pool
OWASP Top Ten 2004 A9 CWE More Specific Denial of Service
The CERT Oracle Secure
Coding Standard for Java
(2011)
TPS00-J Use thread pools to enable graceful
degradation of service during traffic
bursts
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-412: Unrestricted Externally Accessible Lock
Weakness ID : 412
Structure : Simple
Abstraction : Base
Description
The product properly checks for the existence of a lock, but the lock can be externally controlled or
influenced by an actor that is outside of the intended sphere of control.
Extended Description
This prevents the product from acting on associated resources or performing other behaviors that
are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex,
or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite
period of time, then the denial of service could be permanent.
Relationships
CWE Version 4.14
CWE-412: Unrestricted Externally Accessible Lock
CWE-412: Unrestricted Externally Accessible Lock