CWE-245 is a Java weakness: a J2EE application directly manages connections instead of using the container's connection management facilities.
MITRE states that the J2EE standard forbids this. Applications are required to obtain connections to resources through the container's resource management. Every major web application container provides pooled database connection management as part of that framework.
How it happens
A developer calls a driver directly to open a connection, perhaps because it is quick and works in a unit test. Later the code grows its own pooling, retry and cleanup logic. MITRE notes that duplicating the container's functionality is difficult and error prone, which is part of why the standard forbids it.
What an attacker gains
The listed consequence is "Other: Quality Degradation". This is not a direct attack path. Hand managed connections tend to leak, exhaust limits, and skip the credential handling the container provides, which lowers reliability and makes problems harder to reason about.
How to find it
MITRE lists automated static analysis as a detection method. Many static tools can flag direct calls to driver connection APIs in J2EE code. You can also search for direct driver use outside the container's data source lookup.
How to fix it
The record gives no mitigation list. The fix follows from the description: obtain connections through the container's configured data source and let the container pool and close them.
Quick check
Is CWE-245 an exploit on its own?
No. The record lists quality degradation as the consequence. It is a practice weakness that makes failures more likely.
