Skip to content

Passive scanner rules (beta) version 22

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Jun 09:59
pscanrulesBeta-v22
3eb3a04
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

Added

  • Added links to the code in the help.
  • Add info and repo URLs.
  • 'Modern Web Application' scan rule was added, being promoted to Beta.

Changed

  • Update minimum ZAP version to 2.9.0.
  • 'PII Disclosure scanner' alerts and help entry renamed 'PII Disclosure' for clarity and proper title caps.
  • 'PII Disclosure' added further false positive handling with regard to exponential numbers such as 2.4670000000000001E-2 or 2.4670000000000001E2.
  • Maintenance changes.
  • 'Servlet Parameter Pollution' scan rule will now only scan responses for in Context URLs for which the Technology JSP/Serlet is applicable.
  • Updated owasp.org references (Issue 5962).
  • 'PII Disclosure' added support for looking up evidence against an Open Source Bank Identification Number List. Confidence is now modified based on whether the lookup is successful or not. Additional details are added to 'Other Info' if available (Issue 5842).
  • Changed to set Risk Info and Confidence Low for the following passive scan rules: User Controlled Cookie, User Controlled JavaScript Event, and User Controlled Charset.
Assets 3
Loading