Analisi per la console di configurazione di GovWay

Generated on Tue, 24 Feb 2026 05:04:19

ZAP Version: 2.17.0

ZAP by Checkmarx

Summary of Alerts

Risk Level Number of Alerts
High
0
Medium
0
Low
0
Informational
1

Alerts

Name Risk Level Number of Instances
User Controllable HTML Element Attribute (Potential XSS) Informational 2

Passing Rules

Name Rule Type Threshold Strength
Session Management Response Identified Passive MEDIUM -
Verification Request Identified Passive MEDIUM -
Private IP Disclosure Passive MEDIUM -
Session ID in URL Rewrite Passive MEDIUM -
Script Served From Malicious Domain (polyfill) Passive MEDIUM -
ZAP is Out of Date Passive MEDIUM -
Insecure JSF ViewState Passive MEDIUM -
Sub Resource Integrity Attribute Missing Passive MEDIUM -
Java Serialization Object Passive MEDIUM -
Vulnerable JS Library (Powered by Retire.js) Passive MEDIUM -
In Page Banner Information Leak Passive MEDIUM -
Charset Mismatch Passive MEDIUM -
Cookie No HttpOnly Flag Passive MEDIUM -
Cookie Without Secure Flag Passive MEDIUM -
Re-examine Cache-control Directives Passive MEDIUM -
Cross-Domain JavaScript Source File Inclusion Passive MEDIUM -
Content-Type Header Missing Passive MEDIUM -
Anti-clickjacking Header Passive MEDIUM -
X-Content-Type-Options Header Missing Passive MEDIUM -
Application Error Disclosure Passive MEDIUM -
Information Disclosure - Debug Error Messages Passive MEDIUM -
Information Disclosure - Sensitive Information in URL Passive MEDIUM -
Information Disclosure - Sensitive Information in HTTP Referrer Header Passive MEDIUM -
Information Disclosure - Suspicious Comments Passive MEDIUM -
Off-site Redirect Passive MEDIUM -
Cookie Poisoning Passive MEDIUM -
User Controllable Charset Passive MEDIUM -
WSDL File Detection Passive MEDIUM -
Loosely Scoped Cookie Passive MEDIUM -
Viewstate Passive MEDIUM -
Directory Browsing Passive MEDIUM -
Heartbleed OpenSSL Vulnerability (Indicative) Passive MEDIUM -
Strict-Transport-Security Header Passive MEDIUM -
HTTP Server Response Header Passive MEDIUM -
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) Passive MEDIUM -
Content Security Policy (CSP) Header Not Set Passive MEDIUM -
X-Backend-Server Header Information Leak Passive MEDIUM -
Secure Pages Include Mixed Content Passive MEDIUM -
HTTP to HTTPS Insecure Transition in Form Post Passive MEDIUM -
HTTPS to HTTP Insecure Transition in Form Post Passive MEDIUM -
User Controllable JavaScript Event (XSS) Passive MEDIUM -
Big Redirect Detected (Potential Sensitive Information Leak) Passive MEDIUM -
Retrieved from Cache Passive MEDIUM -
X-ChromeLogger-Data (XCOLD) Header Information Leak Passive MEDIUM -
Cookie without SameSite Attribute Passive MEDIUM -
CSP Passive MEDIUM -
X-Debug-Token Information Leak Passive MEDIUM -
Username Hash Found Passive MEDIUM -
X-AspNet-Version Response Header Passive MEDIUM -
PII Disclosure Passive MEDIUM -
Script Passive Scan Rules Passive MEDIUM -
Stats Passive Scan Rule Passive MEDIUM -
Absence of Anti-CSRF Tokens Passive MEDIUM -
Timestamp Disclosure Passive MEDIUM -
Hash Disclosure Passive MEDIUM -
Cross-Domain Misconfiguration Passive MEDIUM -
Weak Authentication Method Passive MEDIUM -
Reverse Tabnabbing Passive MEDIUM -
Modern Web Application Passive MEDIUM -
Authentication Request Identified Passive MEDIUM -

Sites

http://127.0.0.1:8080/govwayConsole/import.do

HTTP Response Code Number of Responses

No Authentication Statistics Found

Parameter Name Type Flags Times Used # Values

Alert Detail

Informational
User Controllable HTML Element Attribute (Potential XSS)
Description
This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.
URL http://127.0.0.1:8080/govwayConsole/import.do?__prevTabKey__=130bb64e-6422-4a45-a383-9a987fa18e33&modalita=import&resetSearch=yes
Node Name http://127.0.0.1:8080/govwayConsole/import.do (__prevTabKey__,modalita,resetSearch)
Method GET
Parameter modalita
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 490 bytes.
Response Body - size: 53,525 bytes.
URL http://127.0.0.1:8080/govwayConsole/import.do?__prevTabKey__=130bb64e-6422-4a45-a383-9a987fa18e33&modalita=import&resetSearch=yes
Node Name http://127.0.0.1:8080/govwayConsole/import.do (__prevTabKey__,modalita,resetSearch)
Method GET
Parameter resetSearch
Attack
Evidence
Request Header - size: 456 bytes.
Request Body - size: 0 bytes.
Response Header - size: 490 bytes.
Response Body - size: 53,525 bytes.
Instances 2
Solution
Validate all input and sanitize output it before writing to any HTML attributes.
Reference https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
Tags OWASP_2017_A01
OWASP_2021_A03
CWE-20
POLICY_PENTEST =
CWE Id 20
WASC Id 20
Plugin Id 10031