CWE-1057 applies when a product has a dedicated, central data manager by design, yet some code performs data access without using it. It affects teams that centralize persistence, caching or query logic in one module and then let exceptions creep in.
How it happens
The data manager is the agreed route. It may batch queries, cache results, or apply common handling. A developer in a hurry opens a connection directly and runs a query inline. The feature ships, and now there are two ways to read the same data.
// Pattern to avoid: a direct query beside a central DataManager
Connection c = DriverManager.getConnection(url);
ResultSet rs = c.createStatement().executeQuery("SELECT name FROM users");
// Better: use the component the design requires
List<String> names = dataManager.userNames();
What an attacker gains
MITRE lists an availability consequence: reduced performance. The central manager "may have been explicitly optimized," so bypassing it can make the product slower. If an attacker can reach that code, the slowdown "might introduce a vulnerability," for example by making resource exhaustion easier.
How to find it
The record lists no detection methods. Search the codebase for direct database client calls outside the data manager package. A simple rule in code review or a dependency check between packages works well.
How to fix it
- Move the direct access into the data manager, or add the method it lacks.
- Make the database client library visible only to the data manager package, so bypassing it fails at build time.
- Document the rule so reviewers know what to reject.
Quick check
Is this mainly a performance weakness?
According to the record, yes. The listed consequence is reduced performance, which can become a security issue if attackers can trigger it.
