Java Package Collection Mode And Collection Mode Override Properties Should Be Disabled

Security

High

System property

Rule ID #

SN-0190

Impact #

The “Collection Mode” property allows for the direct calling of new Java packages that have not been called before. Once enabled, this plugin manages the relationship between the server side code and Collection mode property to enforce security restrictions.

Remediation #

It is recommended to set this property “glide.whitelist.manager.collection_mode.override” to false to close the security gap that exists when importing Java package calls into an instance.

Time to fix

15 min

References #

This rule is linked to Common Weakness Enumeration CWE-862 Missing Authorization.