CWE-106 - Struts: Plug-in Framework not in Use
CWE-106
- Abstraction:
- Variant
- Structure:
- Simple
- Status:
- Draft
- Weakness Name
Struts: Plug-in Framework not in Use
- Description
When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others. Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
- Common Consequences
Scope: Integrity
Impact: Unexpected State
- Related Weaknesses
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2023-06-29
Free security scan for your website