Java Package Collection mode and Collection mode override properties should be disabled
Impact area
Security
Severity
High
Affected element
System property
Rule ID
SN-0190Impact
The "Collection Mode" property allows for the direct calling of new Java packages that have not been called before. Once enabled, this plugin manages the relationship between the server side code and Collection mode property to enforce security restrictions.
Remediation
It is recommended to set this property "glide.whitelist.manager.collection_mode.override" to false to close the security gap that exists when importing Java package calls into an instance.
Time to fix
15 min
References
This rule is linked to Common Weakness Enumeration CWE-862 Missing Authorization.