Skip to content

Passive scanner rules version 39

Choose a tag to compare

View all tags
@zapbot zapbot released this 07 Mar 16:34
· 7640 commits to main since this release
pscanrules-v39
378e22a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Added

  • Alert refs for the alerts which use them (10020 and 10032).

Changed

  • Moved the detail information in Content Security Policy Rule to the otherInfo field and added alertRef ids.
  • Address false positive condition for Timestamp Disclosure scan rule when values are percentages (Issue 7057).
  • Update Cache-control scan rule name, description, and solution to make it more clear that there are cases in which caching is reasonable. Reduced risk to Info (Issue 6462).
  • Maintenance changes.
  • The CSRF Token scan rule will now raise alerts as Medium risk and Low confidence (Issue 7021).

Fixed

  • CSP scan rule will now alert in situations where default-src contains 'unsafe-inline' or is not defined (Issue 7120). In certain situations this may mean a marked increase in CSP related Alerts.
  • A typo was corrected in the CSP scan rule which was causing invalid assessment of "connect-src" directives.
Assets 3
Loading