CWE-1065
Runtime Resource Management Control Element in a Component Built to Run on Application Servers
The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.
Impactr finds and proves whether CWE-1065 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.