DerScanner
Home / Vulnerability Database / Java : Castor query mode is not read-only
Java

Java : Castor query mode is not read-only

Overview

A Castor query in not read-only mode is used. It can have negative performance implications.

Castor is an open source data binding framework for Java.

Using a Castor query in a mode other than Database.READONLY, can badly affect the performance of the application. Request in the Database.READONLY mode run about 7 times faster than queries in default mode (Database.SHARED).

If only reading is needed, using the Database.READONLY mode is consistent with the principle of least privilege.

References

  1. OWASP Top 10 2013-A5-Security Misconfiguration
  2. Castor JDO - Best practice
LOW

DerScanner Severity Score

Do you want to fix Java : Castor query mode is not read-only in your application?

See also

Java

Java : Race condition

Java

Java : Text4Shell Vulnerability

Java

Java : JNI usage