CWE-579
J2EE Bad Practices: Non-serializable Object Stored in Session
The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
Impactr finds and proves whether CWE-579 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.