935
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms J2EE Bad Practices: System.exit()
OWASP Top Ten 2004 A9 CWE More Specific Denial of Service
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR09-J Do not allow untrusted code to
terminate the JVM
Software Fault Patterns SFP3 Use of an improper API
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE-383: J2EE Bad Practices: Direct Use of Threads
Weakness ID : 383
Structure : Simple
Abstraction : Variant
Description
Thread management in a Web application is forbidden in some circumstances and is always highly
error prone.
Extended Description
Thread management in a web application is forbidden by the J2EE standard in some
circumstances and is always highly error prone. Managing threads is difficult and is likely to
interfere in unpredictable ways with the behavior of the application container. Even without
interfering with the container, thread management usually leads to bugs that are hard to detect and
diagnose like deadlock, race conditions, and other synchronization errors.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 695 Use of Low-Level Functionality 1524
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
CWE Version 4.14
CWE-384: Session Fixation
CWE-384: Session Fixation