GovWay Console di Configurazione

Analisi per la console di configurazione di GovWay

Generated on Tue, 24 Feb 2026 04:55:47

ZAP Version: 2.17.0

ZAP by Checkmarx

Summary of Alerts

Risk Level Number of Alerts
High
0
Medium
0
Low
0
Informational
1

Alerts

Name Risk Level Number of Instances
User Controllable HTML Element Attribute (Potential XSS) Informational 25

Passing Rules

Name Rule Type Threshold Strength
Directory Browsing Active MEDIUM MEDIUM
Path Traversal Active MEDIUM MEDIUM
Remote File Inclusion Active MEDIUM MEDIUM
XSLT Injection Active MEDIUM MEDIUM
Server Side Code Injection Active MEDIUM MEDIUM
XPath Injection Active MEDIUM MEDIUM
Remote OS Command Injection Active MEDIUM MEDIUM
XML External Entity Attack Active MEDIUM MEDIUM
Generic Padding Oracle Active MEDIUM MEDIUM
SOAP Action Spoofing Active MEDIUM MEDIUM
SOAP XML Injection Active MEDIUM MEDIUM
Heartbleed OpenSSL Vulnerability Active MEDIUM MEDIUM
Buffer Overflow Active MEDIUM MEDIUM
Source Code Disclosure - CVE-2012-1823 Active MEDIUM MEDIUM
Format String Error Active MEDIUM MEDIUM
Server Side Template Injection Active MEDIUM MEDIUM
Remote Code Execution - CVE-2012-1823 Active MEDIUM MEDIUM
Cloud Metadata Potentially Exposed Active MEDIUM MEDIUM
External Redirect Active MEDIUM MEDIUM
Remote OS Command Injection (Time Based) Active MEDIUM MEDIUM
Server Side Template Injection (Blind) Active MEDIUM MEDIUM
Source Code Disclosure - /WEB-INF Folder Active MEDIUM MEDIUM
HTTPS Content Available via HTTP Active MEDIUM MEDIUM
Remote Code Execution - Shell Shock Active MEDIUM MEDIUM
CRLF Injection Active MEDIUM MEDIUM
Parameter Tampering Active MEDIUM MEDIUM
Server Side Include Active MEDIUM MEDIUM
Swagger UI Secret & Vulnerability Detector Active MEDIUM MEDIUM
GET for POST Active MEDIUM MEDIUM
Cross Site Scripting (Reflected) Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) Active MEDIUM MEDIUM
Script Active Scan Rules Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Prime Active MEDIUM MEDIUM
Cross Site Scripting (Persistent) - Spider Active MEDIUM MEDIUM
SQL Injection Active MEDIUM MEDIUM
SQL Injection - MySQL (Time Based) Active MEDIUM MEDIUM
SQL Injection - Hypersonic SQL (Time Based) Active MEDIUM MEDIUM
SQL Injection - Oracle (Time Based) Active MEDIUM MEDIUM
SQL Injection - PostgreSQL (Time Based) Active MEDIUM MEDIUM
Cross Site Scripting (DOM Based) Active MEDIUM MEDIUM
SQL Injection - MsSQL (Time Based) Active MEDIUM MEDIUM
ELMAH Information Leak Active MEDIUM MEDIUM
Trace.axd Information Leak Active MEDIUM MEDIUM
.htaccess Information Leak Active MEDIUM MEDIUM
.env Information Leak Active MEDIUM MEDIUM
Hidden File Finder Active MEDIUM MEDIUM
Spring Actuator Information Leak Active MEDIUM MEDIUM
Log4Shell Active MEDIUM MEDIUM
Exponential Entity Expansion (Billion Laughs Attack) Active MEDIUM MEDIUM
Spring4Shell Active MEDIUM MEDIUM
Remote Code Execution (React2Shell) Active MEDIUM MEDIUM
User Agent Fuzzer Active MEDIUM MEDIUM
HTTP Only Site Active MEDIUM MEDIUM
Session Management Response Identified Passive MEDIUM -
Verification Request Identified Passive MEDIUM -
Private IP Disclosure Passive MEDIUM -
Session ID in URL Rewrite Passive MEDIUM -
Script Served From Malicious Domain (polyfill) Passive MEDIUM -
ZAP is Out of Date Passive MEDIUM -
Insecure JSF ViewState Passive MEDIUM -
Sub Resource Integrity Attribute Missing Passive MEDIUM -
Java Serialization Object Passive MEDIUM -
Vulnerable JS Library (Powered by Retire.js) Passive MEDIUM -
In Page Banner Information Leak Passive MEDIUM -
Charset Mismatch Passive MEDIUM -
Cookie No HttpOnly Flag Passive MEDIUM -
Cookie Without Secure Flag Passive MEDIUM -
Re-examine Cache-control Directives Passive MEDIUM -
Cross-Domain JavaScript Source File Inclusion Passive MEDIUM -
Content-Type Header Missing Passive MEDIUM -
Anti-clickjacking Header Passive MEDIUM -
X-Content-Type-Options Header Missing Passive MEDIUM -
Application Error Disclosure Passive MEDIUM -
Information Disclosure - Debug Error Messages Passive MEDIUM -
Information Disclosure - Sensitive Information in URL Passive MEDIUM -
Information Disclosure - Sensitive Information in HTTP Referrer Header Passive MEDIUM -
Information Disclosure - Suspicious Comments Passive MEDIUM -
Off-site Redirect Passive MEDIUM -
Cookie Poisoning Passive MEDIUM -
User Controllable Charset Passive MEDIUM -
WSDL File Detection Passive MEDIUM -
Loosely Scoped Cookie Passive MEDIUM -
Viewstate Passive MEDIUM -
Directory Browsing Passive MEDIUM -
Heartbleed OpenSSL Vulnerability (Indicative) Passive MEDIUM -
Strict-Transport-Security Header Passive MEDIUM -
HTTP Server Response Header Passive MEDIUM -
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) Passive MEDIUM -
Content Security Policy (CSP) Header Not Set Passive MEDIUM -
X-Backend-Server Header Information Leak Passive MEDIUM -
Secure Pages Include Mixed Content Passive MEDIUM -
HTTP to HTTPS Insecure Transition in Form Post Passive MEDIUM -
HTTPS to HTTP Insecure Transition in Form Post Passive MEDIUM -
User Controllable JavaScript Event (XSS) Passive MEDIUM -
Big Redirect Detected (Potential Sensitive Information Leak) Passive MEDIUM -
Retrieved from Cache Passive MEDIUM -
X-ChromeLogger-Data (XCOLD) Header Information Leak Passive MEDIUM -
Cookie without SameSite Attribute Passive MEDIUM -
CSP Passive MEDIUM -
X-Debug-Token Information Leak Passive MEDIUM -
Username Hash Found Passive MEDIUM -
X-AspNet-Version Response Header Passive MEDIUM -
PII Disclosure Passive MEDIUM -
Script Passive Scan Rules Passive MEDIUM -
Stats Passive Scan Rule Passive MEDIUM -
Absence of Anti-CSRF Tokens Passive MEDIUM -
Timestamp Disclosure Passive MEDIUM -
Hash Disclosure Passive MEDIUM -
Cross-Domain Misconfiguration Passive MEDIUM -
Weak Authentication Method Passive MEDIUM -
Reverse Tabnabbing Passive MEDIUM -
Modern Web Application Passive MEDIUM -
Authentication Request Identified Passive MEDIUM -

Sites

Number of Sites tree nodes actively scanned: 1

http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

Alert Detail

Informational
User Controllable HTML Element Attribute (Potential XSS)
Description
This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTCacheAlgoritmo
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheAlgoritmo=LRU The user-controlled value was: lru
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTCacheDimensione
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheDimensione=10000 The user-controlled value was: 10000
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTCacheLifeTime
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheLifeTime=300 The user-controlled value was: 300
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTCacheStato
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheStato=disabilitato The user-controlled value was: disabilitato
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTFirstTime
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTFirstTime=false The user-controlled value was: false
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter ctHttpMode
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [option] tag [value] attribute The user input found was: ctHttpMode=default The user-controlled value was: default
Request Header - size: 493 bytes.
Request Body - size: 857 bytes.
Response Header - size: 490 bytes.
Response Body - size: 70,404 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTNumMaxReqStato
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [option] tag [value] attribute The user input found was: CTNumMaxReqStato=abilitato The user-controlled value was: abilitato
Request Header - size: 493 bytes.
Request Body - size: 857 bytes.
Response Header - size: 490 bytes.
Response Body - size: 70,404 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTNumMaxReqTipoErrore
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTNumMaxReqTipoErrore=http429 The user-controlled value was: http429
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTNumMaxReqTipoErroreDescr
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTNumMaxReqTipoErroreDescr=true The user-controlled value was: true
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTpercentualeCongestioneThreshold
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [option] tag [value] attribute The user input found was: CTpercentualeCongestioneThreshold=55 The user-controlled value was: 55
Request Header - size: 493 bytes.
Request Body - size: 857 bytes.
Response Header - size: 490 bytes.
Response Body - size: 70,404 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTRateLimitTipoErrore
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTRateLimitTipoErrore=http429 The user-controlled value was: http429
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTRateLimitTipoErroreDescr
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTRateLimitTipoErroreDescr=true The user-controlled value was: true
Request Header - size: 561 bytes.
Request Body - size: 864 bytes.
Response Header - size: 490 bytes.
Response Body - size: 59,553 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter CTStatoControlloCongestione
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [option] tag [value] attribute The user input found was: CTStatoControlloCongestione=abilitato The user-controlled value was: abilitato
Request Header - size: 493 bytes.
Request Body - size: 857 bytes.
Response Header - size: 490 bytes.
Response Body - size: 70,404 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter ctSyncMode
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [option] tag [value] attribute The user input found was: ctSyncMode=default The user-controlled value was: default
Request Header - size: 493 bytes.
Request Body - size: 857 bytes.
Response Header - size: 490 bytes.
Response Body - size: 70,404 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTConnectionTimeoutErogazione,CTConnectionTimeoutFruizione,CTFirstTime,CTNumMaxReqSoglia,CTNumMaxReqStato,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,CTReadTimeoutErogazione,CTReadTimeoutFruizione,CTStatoControlloCongestione,CTTempoMedioRispostaErogazione,CTTempoMedioRispostaFruizione,CTpercentualeCongestioneThreshold,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpMode,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl,ctSyncMode,edit-mode)
Method POST
Parameter edit-mode
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: edit-mode=end The user-controlled value was: end
Request Header - size: 493 bytes.
Request Body - size: 857 bytes.
Response Header - size: 490 bytes.
Response Body - size: 70,404 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter ConfigurazioneFirstTime
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: ConfigurazioneFirstTime=false The user-controlled value was: false
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTCacheAlgoritmo
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheAlgoritmo=LRU The user-controlled value was: lru
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTCacheDimensione
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheDimensione=10000 The user-controlled value was: 10000
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTCacheLifeTime
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTCacheLifeTime=300 The user-controlled value was: 300
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTCacheStato
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [option] tag [value] attribute The user input found was: CTCacheStato=disabilitato The user-controlled value was: disabilitato
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTFirstTime
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTFirstTime=false The user-controlled value was: false
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTNumMaxReqTipoErrore
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTNumMaxReqTipoErrore=http429 The user-controlled value was: http429
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTNumMaxReqTipoErroreDescr
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTNumMaxReqTipoErroreDescr=true The user-controlled value was: true
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTRateLimitTipoErrore
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTRateLimitTipoErrore=http429 The user-controlled value was: http429
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
URL http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do
Node Name http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do ()(CTCacheAlgoritmo,CTCacheDimensione,CTCacheIdleTime,CTCacheLifeTime,CTCacheStato,CTFirstTime,CTNumMaxReqTipoErrore,CTNumMaxReqTipoErroreDescr,CTRateLimitTipoErrore,CTRateLimitTipoErroreDescr,ConfigurazioneFirstTime,__i_hidden_locklabel_,__i_hidden_lockurl_,__i_hidden_lockvalue_,_csrf,ctCount,ctEngineType,ctHttpQuota,ctHttpRemaining,ctHttpReset,ctHttpRetryAfter,ctHttpRetryAfterBackoff,ctImpl)
Method POST
Parameter CTRateLimitTipoErroreDescr
Attack
Evidence
Other Info User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL: http://127.0.0.1:8080/govwayConsole/configurazioneControlloTraffico.do appears to include user input in: a(n) [input] tag [value] attribute The user input found was: CTRateLimitTipoErroreDescr=true The user-controlled value was: true
Request Header - size: 493 bytes.
Request Body - size: 520 bytes.
Response Header - size: 490 bytes.
Response Body - size: 68,477 bytes.
Instances 25
Solution
Validate all input and sanitize output it before writing to any HTML attributes.
Reference https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
Tags OWASP_2017_A01
OWASP_2021_A03
CWE-20
POLICY_PENTEST =
CWE Id 20
WASC Id 20
Plugin Id 10031