Backslash Vulnerability Database 
Struts: Plug-in Framework not in Use
Struts: Plug-in Framework not in Use
Struts: Plug-in Framework not in Use
CWE-106
Short description
When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
Extended description
Unchecked input is the leading cause of vulnerabilities in J2EE applications. Unchecked input leads to cross-site scripting, process control, and SQL injection vulnerabilities, among others.
Although J2EE applications are not generally susceptible to memory corruption attacks, if a J2EE application interfaces with native code that does not perform array bounds checking, an attacker may be able to use an input validation mistake in the J2EE application to launch a buffer overflow attack.
Best practices to prevent this CWE
Phase: Architecture and Design
Strategy: Input Validation
Use an input validation framework such as Struts.
Phase: Architecture and Design
Strategy: Libraries or Frameworks
Use an input validation framework such as Struts.
Phase: Implementation
Strategy: Input Validation
- Phone number fields contain only valid characters in phone numbers
- Boolean values are only "T" or "F"
- Free-form strings are of a reasonable length and composition
Phase: Implementation
Strategy: Libraries or Frameworks
- Phone number fields contain only valid characters in phone numbers
- Boolean values are only "T" or "F"
- Free-form strings are of a reasonable length and composition
