{"id":"https://openalex.org/W2158591033","doi":"https://doi.org/10.1145/2771284.2771286","title":"Understanding caller-sensitive method vulnerabilities: a class of access control vulnerabilities in the Java platform","display_name":"Understanding caller-sensitive method vulnerabilities: a class of access control vulnerabilities in the Java platform","publication_year":2015,"publication_date":"2015-06-08","ids":{"openalex":"https://openalex.org/W2158591033","doi":"https://doi.org/10.1145/2771284.2771286","mag":"2158591033"},"language":"en","primary_location":{"id":"doi:10.1145/2771284.2771286","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2771284.2771286","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 4th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5110303479","display_name":"Cristina Cifuentes","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cristina Cifuentes","raw_affiliation_strings":["Oracle Labs, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Oracle Labs, Australia","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021842933","display_name":"Andrew Gross","orcid":null},"institutions":[{"id":"https://openalex.org/I1342911587","display_name":"Oracle (United States)","ror":"https://ror.org/006c77m33","country_code":"US","type":"company","lineage":["https://openalex.org/I1342911587"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Andrew Gross","raw_affiliation_strings":["Oracle, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Oracle, USA","institution_ids":["https://openalex.org/I1342911587"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040463119","display_name":"Nathan Keynes","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nathan Keynes","raw_affiliation_strings":["Oracle, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Oracle, Australia","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.2344,"has_fulltext":false,"cited_by_count":14,"citation_normalized_percentile":{"value":0.81449722,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"7","last_page":"12"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9952999949455261,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9952999949455261,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9886000156402588,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9677000045776367,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.8275465965270996},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8240681886672974},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.6631186604499817},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.628537654876709},{"id":"https://openalex.org/keywords/sandbox","display_name":"Sandbox (software development)","score":0.6192275285720825},{"id":"https://openalex.org/keywords/oracle","display_name":"Oracle","score":0.5431304574012756},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.524222731590271},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4838908612728119},{"id":"https://openalex.org/keywords/security-bug","display_name":"Security bug","score":0.4635986387729645},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.4433511793613434},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.27594414353370667},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.2592310905456543},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.20936468243598938},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.14554986357688904}],"concepts":[{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.8275465965270996},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8240681886672974},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.6631186604499817},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.628537654876709},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.6192275285720825},{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.5431304574012756},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.524222731590271},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4838908612728119},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.4635986387729645},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.4433511793613434},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.27594414353370667},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2592310905456543},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.20936468243598938},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.14554986357688904},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2771284.2771286","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2771284.2771286","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 4th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7400000095367432}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":3,"referenced_works":["https://openalex.org/W2035124535","https://openalex.org/W2121251946","https://openalex.org/W2147221906"],"related_works":["https://openalex.org/W1978034799","https://openalex.org/W2007984522","https://openalex.org/W4384518368","https://openalex.org/W2155353733","https://openalex.org/W125279808","https://openalex.org/W4239788664","https://openalex.org/W2557302400","https://openalex.org/W2504659933","https://openalex.org/W2150933192","https://openalex.org/W3041665175"],"abstract_inverted_index":{"Late":[0],"2012":[1],"and":[2,17,48,57,79,108,164],"early":[3],"2013":[4],"saw":[5],"a":[6,33,69,97],"spike":[7],"of":[8,25,32,35,42,100,123,126,140,159,190],"new":[9,93],"Java":[10,27,94,133,161],"vulnerabilities":[11,30,74,95,129],"being":[12],"reported":[13],"in":[14,19,86,156],"0-day":[15],"attacks":[16],"used":[18],"the":[20,26,61,87,102,132,141,147,150,157,160,170,174,179],"wild,":[21],"that":[22,82,130],"allowed":[23],"bypass":[24],"sandbox.":[28],"These":[29],"were":[31],"variety":[34],"types:":[36],"unguarded":[37],"caller-sensitive":[38,135],"methods,":[39],"unsafe":[40],"use":[41],"doPrivileged,":[43],"invalid":[44,46],"deserialisation,":[45],"serialisation,":[47],"more.":[49],"Oracle":[50],"reacted":[51],"quickly":[52],"by":[53],"making":[54],"available":[55],"patches":[56],"has":[58],"now":[59],"increased":[60],"scheduled":[62],"patch":[63],"update":[64],"cycle":[65],"to":[66,112,144,146,166,177,183,186],"4":[67],"releases":[68],"year.":[70],"Unlike":[71],"more":[72],"traditional":[73],"such":[75],"as":[76],"buffer":[77],"overflow":[78],"cross-site":[80],"scripting":[81],"have":[83],"been":[84],"studied":[85],"literature":[88],"for":[89],"many":[90],"years,":[91],"these":[92],"lack":[96],"clear":[98],"definition":[99],"what":[101,109,149],"corresponding":[103],"security":[104,162,180],"bug":[105,114,181],"type":[106,125,189],"is,":[107,152],"rules":[110],"apply":[111],"each":[113],"type.":[115],"In":[116],"this":[117,188],"paper":[118,142],"we":[119],"give":[120],"an":[121],"overview":[122],"one":[124],"access":[127],"control":[128],"affects":[131],"platform---unguarded":[134],"method":[136],"calls.":[137],"The":[138],"aim":[139,175],"is":[143,176],"explain":[145],"practitioner":[148],"vulnerability":[151],"why":[153],"it":[154],"happens":[155],"context":[158],"model,":[163],"how":[165],"fix":[167],"it.":[168],"For":[169],"program":[171],"analysis":[172],"community,":[173],"define":[178],"type,":[182],"be":[184],"able":[185],"detect":[187],"vulnerability.":[191]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":4},{"year":2017,"cited_by_count":5},{"year":2016,"cited_by_count":1},{"year":2012,"cited_by_count":1}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2025-10-10T00:00:00"}