Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cuba-platform/cuba

              master @ eaa926f
            

151

Fixes

CVEs

CRITICAL

Peak severity

32.5%

Coverage

Highlights

Auth Bypass: 96 prior fixes. Scrutinize any change in this area.

modules/global/src/com/haulmont/cuba/core/sys/SecurityImpl.java: most-fixed (6 issues). Treat as high-risk during review.

71 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Resolving permissions for extended entities or wildcards improperly can bypass access control, allowing unauthorized access to protected data structures. Developers must map permissions back to original base metaclasses consistently.

Remote Code Execution: Unsafe XStream serialization of entity snapshots and configurations allows arbitrary code execution. Whitelists of safe classes must be strictly configured on all XStream instances.

Auth Bypass: Validating permissions on nested or hierarchical entity property paths using incorrect enclosing classes or defaulting to weak read checks instead of update checks allows unauthorized data modification.