Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.
EJB Bad Practices: Use of AWT Swing
This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses AWT or Swing UI toolkits, violating the EJB specification's design principles.
What is CWE-575?
Real-world CVEs caused by CWE-575
No public CVE references are linked to this CWE in MITRE's catalog yet.
Step-by-step attacker path
- 1
The following Java example is a simple converter class for converting US dollars to Yen. This converter class demonstrates the improper practice of using a stateless session Enterprise JavaBean that implements an AWT Component and AWT keyboard event listener to retrieve keyboard input from the user for the amount of the US dollars to convert to Yen.
- 2
This use of the AWT and Swing APIs within any kind of Enterprise JavaBean not only violates the restriction of the EJB specification against using AWT or Swing within an EJB but also violates the intended use of Enterprise JavaBeans to separate business logic from presentation logic.
- 3
The Stateless Session Enterprise JavaBean should contain only business logic. Presentation logic should be provided by some other mechanism such as Servlets or Java Server Pages (JSP) as in the following Java/JSP example.
Vulnerable Java
The following Java example is a simple converter class for converting US dollars to Yen. This converter class demonstrates the improper practice of using a stateless session Enterprise JavaBean that implements an AWT Component and AWT keyboard event listener to retrieve keyboard input from the user for the amount of the US dollars to convert to Yen.
@Stateless
public class ConverterSessionBean extends Component implements KeyListener, ConverterSessionRemote {
```
/* member variables for receiving keyboard input using AWT API */*
...
private StringBuffer enteredText = new StringBuffer();
*/* conversion rate on US dollars to Yen */*
private BigDecimal yenRate = new BigDecimal("115.3100");
public ConverterSessionBean() {
```
super();
```
/* method calls for setting up AWT Component for receiving keyboard input */*
...
addKeyListener(this);}
public BigDecimal dollarToYen(BigDecimal dollars) {
```
BigDecimal result = dollars.multiply(yenRate);
return result.setScale(2, BigDecimal.ROUND_DOWN);
}
```
/* member functions for implementing AWT KeyListener interface */*
public void keyTyped(KeyEvent event) {
```
...
}
public void keyPressed(KeyEvent e) {
}
public void keyReleased(KeyEvent e) {
}
```
/* member functions for receiving keyboard input and displaying output */*
public void paint(Graphics g) {...}
...} Secure Java
The Stateless Session Enterprise JavaBean should contain only business logic. Presentation logic should be provided by some other mechanism such as Servlets or Java Server Pages (JSP) as in the following Java/JSP example.
@Stateless
public class ConverterSessionBean implements ConverterSessionRemoteInterface {
```
/* conversion rate on US dollars to Yen */*
private BigDecimal yenRate = new BigDecimal("115.3100");
public ConverterSessionBean() {
}
*/* remote method to convert US dollars to Yen */*
public BigDecimal dollarToYen(BigDecimal dollars) {
```
BigDecimal result = dollars.multiply(yenRate);
return result.setScale(2, BigDecimal.ROUND_DOWN);
}
} How to prevent CWE-575
- Architecture and Design Do not use AWT/Swing when writing EJBs.
How to detect CWE-575
Run dynamic application security testing against the live endpoint.
Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.
Code review: flag any new code that handles input from this surface without using the validated framework helpers.
Plexicus auto-detects CWE-575 and opens a fix PR in under 60 seconds.
Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.
Frequently asked questions
What is CWE-575?
This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses AWT or Swing UI toolkits, violating the EJB specification's design principles.
How serious is CWE-575?
MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.
What languages or platforms are affected by CWE-575?
MITRE lists the following affected platforms: Java.
How can I prevent CWE-575?
Do not use AWT/Swing when writing EJBs.
How does Plexicus detect and fix CWE-575?
Plexicus's SAST engine matches the data-flow signature for CWE-575 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.
Where can I learn more about CWE-575?
MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/575.html. You can also reference OWASP and NIST documentation for adjacent guidance.
Weaknesses related to CWE-575
Use of Low-Level Functionality
This vulnerability occurs when code bypasses high-level framework controls by directly using low-level system functions, violating the…
Direct Use of Unsafe JNI
This weakness occurs when a Java application directly calls native code through the Java Native Interface (JNI), exposing the entire…
J2EE Bad Practices: Direct Management of Connections
This vulnerability occurs when a J2EE application handles database connections directly instead of using the container's built-in…
J2EE Bad Practices: Direct Use of Sockets
This vulnerability occurs when a J2EE application creates network sockets directly, bypassing the container-managed communication…
J2EE Bad Practices: Direct Use of Threads
Creating or managing threads directly within a J2EE application is a risky practice that violates the platform's standards and often leads…
EJB Bad Practices: Use of Synchronization Primitives
This vulnerability occurs when an Enterprise JavaBeans (EJB) component improperly uses thread synchronization primitives, violating the…
EJB Bad Practices: Use of Java I/O
This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses Java I/O (java.io) operations to access the file…
Don't Let Security
Weigh You Down.
Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.