The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to \"Auto-Detect\" then this rule will change the session management to use the tokens identified.
", "instances":[ { "id": "6261", "uri": "http://127.0.0.1:8080/govwayConsole/configurazionePolicyGestioneTokenList.do?_tabKey_infoType=aa", "nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/configurazionePolicyGestioneTokenList.do (_tabKey_infoType)(__i_hidden_title_iconUso_0_0,__i_hidden_title_iconUso_0_4,__i_hidden_title_iconUso_1_0,__i_hidden_title_iconUso_1_4,_csrf,be_name_0,chkAll,search,selectcheckbox,url_entry_0,url_entry_1)", "method": "POST", "param": "JSESSIONID_GW_CONSOLE", "attack": "", "evidence": "JSESSIONID_GW_CONSOLE", "otherinfo": "cookie:JSESSIONID_GW_CONSOLE" } ], "count": "1", "systemic": false, "solution": "This is an informational alert rather than a vulnerability and so there is nothing to fix.
", "otherinfo": "cookie:JSESSIONID_GW_CONSOLE
", "reference": "https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id/
", "cweid": "-1", "wascid": "-1", "sourceid": "726" }, { "pluginid": "10031", "alertRef": "10031", "alert": "User Controllable HTML Element Attribute (Potential XSS)", "name": "User Controllable HTML Element Attribute (Potential XSS)", "riskcode": "0", "confidence": "1", "riskdesc": "Informational (Low)", "desc": "This check looks at user-supplied input in query string parameters and POST data to identify where certain HTML attribute values might be controlled. This provides hot-spot detection for XSS (cross-site scripting) that will require further review by a security analyst to determine exploitability.
", "instances":[ { "id": "5334", "uri": "http://127.0.0.1:8080/govwayConsole/configurazionePolicyGestioneTokenList.do?_tabKey_infoType=aa", "nodeName": "http:\/\/127.0.0.1:8080\/govwayConsole\/configurazionePolicyGestioneTokenList.do (_tabKey_infoType)(__i_hidden_title_iconUso_0_0,__i_hidden_title_iconUso_0_4,__i_hidden_title_iconUso_10_0,__i_hidden_title_iconUso_10_4,__i_hidden_title_iconUso_11_0,__i_hidden_title_iconUso_11_4,__i_hidden_title_iconUso_12_0,__i_hidden_title_iconUso_12_4,__i_hidden_title_iconUso_13_0,__i_hidden_title_iconUso_13_4,__i_hidden_title_iconUso_14_0,__i_hidden_title_iconUso_14_4,__i_hidden_title_iconUso_15_0,__i_hidden_title_iconUso_15_4,__i_hidden_title_iconUso_16_0,__i_hidden_title_iconUso_16_4,__i_hidden_title_iconUso_17_0,__i_hidden_title_iconUso_17_4,__i_hidden_title_iconUso_18_0,__i_hidden_title_iconUso_18_4,__i_hidden_title_iconUso_19_0,__i_hidden_title_iconUso_19_4,__i_hidden_title_iconUso_1_0,__i_hidden_title_iconUso_1_4,__i_hidden_title_iconUso_2_0,__i_hidden_title_iconUso_2_4,__i_hidden_title_iconUso_3_0,__i_hidden_title_iconUso_3_4,__i_hidden_title_iconUso_4_0,__i_hidden_title_iconUso_4_4,__i_hidden_title_iconUso_5_0,__i_hidden_title_iconUso_5_4,__i_hidden_title_iconUso_6_0,__i_hidden_title_iconUso_6_4,__i_hidden_title_iconUso_7_0,__i_hidden_title_iconUso_7_4,__i_hidden_title_iconUso_8_0,__i_hidden_title_iconUso_8_4,__i_hidden_title_iconUso_9_0,__i_hidden_title_iconUso_9_4,_csrf,be_name_0,chkAll,limit,search,selectcheckbox,url_entry_0,url_entry_1,url_entry_10,url_entry_11,url_entry_12,url_entry_13,url_entry_14,url_entry_15,url_entry_16,url_entry_17,url_entry_18,url_entry_19,url_entry_2,url_entry_3,url_entry_4,url_entry_5,url_entry_6,url_entry_7,url_entry_8,url_entry_9)", "method": "POST", "param": "search", "attack": "", "evidence": "", "otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:\n\nhttp://127.0.0.1:8080/govwayConsole/configurazionePolicyGestioneTokenList.do?_tabKey_infoType=aa\n\nappears to include user input in:\na(n) [input] tag [value] attribute\n\nThe user input found was:\nsearch=ZAP\n\nThe user-controlled value was:\nzap" } ], "count": "1", "systemic": false, "solution": "Validate all input and sanitize output it before writing to any HTML attributes.
", "otherinfo": "User-controlled HTML attribute values were found. Try injecting special characters to see if XSS might be possible. The page at the following URL:
http://127.0.0.1:8080/govwayConsole/configurazionePolicyGestioneTokenList.do?_tabKey_infoType=aa
appears to include user input in:
a(n) [input] tag [value] attribute
The user input found was:
search=ZAP
The user-controlled value was:
zap
", "reference": "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
", "cweid": "20", "wascid": "20", "sourceid": "691" } ] } ], "sequences":[ ] }