A J2EE application uses System.exit(), which also shuts down its container.
View on MITREIt is never a good idea for a web application to attempt to shut down the application container. Access to a function that can shut down the application is an avenue for Denial of Service (DoS) attacks.
The shutdown function should be a privileged function available only to a properly authorized administrative user
Web applications should not call methods that cause the virtual machine to exit, such as System.exit()
Web applications should also not throw any Throwables to the application server as this may adversely affect the container.
Non-web applications may have a main() method that contains a System.exit(), but generally should not call System.exit() from other locations in the code
No detection method information available for this CWE.
Included in the doPost() method defined below is a call to System.exit() in the event of a specific exception.
No relationship information available for this CWE.
CWE-382: J2EE Bad Practices: Use of System.exit() is a Common Weakness Enumeration (CWE) entry maintained by MITRE. A J2EE application uses System.exit(), which also shuts down its container. It is never a good idea for a web application to attempt to shut down the application container. Access to a function that can shut down the application is an avenue for Denial of Service (DoS) attacks.
If exploited, CWE-382 (J2EE Bad Practices: Use of System.exit()) it can compromise Availability, leading to outcomes such as DoS: Crash, Exit, or Restart.
Recommended mitigations for CWE-382 include: The shutdown function should be a privileged function available only to a properly authorized administrative user Web applications should not call methods that cause the virtual machine to exit, such as System.exit() Web applications should also not throw any Throwables to the application server as this may adversely affect the container.
CWE-382 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-382 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.