CWE-575 is an EJB rule violation: a bean uses AWT or Swing. The specification says an enterprise bean must not use AWT to output to a display or take input from a keyboard.
The justification MITRE quotes is practical: most servers do not allow direct interaction between an application program and a keyboard or display attached to the server system. A bean that waits for keyboard input has nobody to talk to.
How it happens
MITRE's example is a currency converter written as a stateless session bean that extends an AWT Component and implements a keyboard listener to read the dollar amount.
// Vulnerable: business logic mixed with GUI classes
@Stateless
public class ConverterSessionBean extends Component
implements KeyListener, ConverterSessionRemote {
...
}
It may run on a developer machine and fail on a headless server, or hang waiting for input.
What an attacker gains
MITRE lists quality degradation. The risk is availability: beans that block or fail break the service.
How to find it
Search bean classes for java.awt and javax.swing imports. No detection methods are listed in the record.
How to fix it
MITRE's mitigation: do not use AWT or Swing when writing EJBs. Keep presentation in a client, and pass values into the bean as method arguments.
@Stateless
public class ConverterSessionBean implements ConverterSessionRemote {
public BigDecimal dollarToYen(BigDecimal dollars) {
return dollars.multiply(RATE);
}
}
Quick check
Why can't a bean use AWT?
Servers generally have no attached keyboard or display for the application to use.
The free in-browser scan at gold.safeguard.sh/scan lists the dependencies in your manifest. No login is needed, the file stays on your machine, and it handles up to 100 dependencies.
