Java Package Collection mode and Collection mode override properties should be disabled

Impact area

Security

Severity

High

Affected element

System property

Rule ID

SN-0190

Impact

The "Collection Mode" property allows for the direct calling of new Java packages that have not been called before. Once enabled, this plugin manages the relationship between the server side code and Collection mode property to enforce security restrictions.

Remediation

It is recommended to set this property "glide.whitelist.manager.collection_mode.override" to false to close the security gap that exists when importing Java package calls into an instance.

Time to fix

15 min

References

This rule is linked to Common Weakness Enumeration CWE-862 Missing Authorization.




Last modified on Oct 13, 2020