# ZAP Scanning Report

### Generated on Sat, 16 Aug 2025 20:56:46

### ZAP Version: 2.16.1

#### ZAP by Checkmarx

### Summary of Alerts

Risk Level | Number of Alerts
--- | ---
High | 0
Medium | 1
Low | 0
Informational | 0
False Positives: | 0

### Summary of Sequences

For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).

### Alerts

Name | Risk Level | Number of Instances
--- | --- | ---
Content Security Policy (CSP) Header Not Set | Medium | 7

### Passing Rules

Name | Rule Type | Threshold | Strength
--- | --- | --- | ---
Server Side Template Injection | Active | MEDIUM | MEDIUM
SQL Injection | Active | MEDIUM | MEDIUM
External Redirect | Active | MEDIUM | MEDIUM
Remote OS Command Injection | Active | MEDIUM | MEDIUM
Remote File Inclusion | Active | MEDIUM | MEDIUM
Parameter Tampering | Active | MEDIUM | MEDIUM
Log4Shell | Active | MEDIUM | MEDIUM
Cross Site Scripting (Reflected) | Active | MEDIUM | MEDIUM
Server Side Request Forgery | Active | MEDIUM | MEDIUM
Text4shell (CVE-2022-42889) | Active | MEDIUM | MEDIUM
Session Management Response Identified | Passive | MEDIUM | -
Verification Request Identified | Passive | MEDIUM | -
Private IP Disclosure | Passive | MEDIUM | -
Session ID in URL Rewrite | Passive | MEDIUM | -
Script Served From Malicious Domain (polyfill) | Passive | MEDIUM | -
ZAP is Out of Date | Passive | MEDIUM | -
Insecure JSF ViewState | Passive | MEDIUM | -
Vulnerable JS Library (Powered by Retire.js) | Passive | MEDIUM | -
Charset Mismatch | Passive | MEDIUM | -
Cookie No HttpOnly Flag | Passive | MEDIUM | -
Cookie Without Secure Flag | Passive | MEDIUM | -
Re-examine Cache-control Directives | Passive | MEDIUM | -
Cross-Domain JavaScript Source File Inclusion | Passive | MEDIUM | -
Content-Type Header Missing | Passive | MEDIUM | -
Anti-clickjacking Header | Passive | MEDIUM | -
X-Content-Type-Options Header Missing | Passive | MEDIUM | -
Application Error Disclosure | Passive | MEDIUM | -
Information Disclosure - Debug Error Messages | Passive | MEDIUM | -
Information Disclosure - Sensitive Information in URL | Passive | MEDIUM | -
Information Disclosure - Sensitive Information in HTTP Referrer Header | Passive | MEDIUM | -
Information Disclosure - Suspicious Comments | Passive | OFF | -
Off-site Redirect | Passive | MEDIUM | -
Cookie Poisoning | Passive | MEDIUM | -
User Controllable Charset | Passive | MEDIUM | -
User Controllable HTML Element Attribute (Potential XSS) | Passive | MEDIUM | -
WSDL File Detection | Passive | MEDIUM | -
Loosely Scoped Cookie | Passive | MEDIUM | -
Viewstate | Passive | MEDIUM | -
Directory Browsing | Passive | MEDIUM | -
Heartbleed OpenSSL Vulnerability (Indicative) | Passive | MEDIUM | -
Strict-Transport-Security Header | Passive | MEDIUM | -
HTTP Server Response Header | Passive | MEDIUM | -
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) | Passive | MEDIUM | -
X-Backend-Server Header Information Leak | Passive | MEDIUM | -
Secure Pages Include Mixed Content | Passive | MEDIUM | -
HTTP to HTTPS Insecure Transition in Form Post | Passive | MEDIUM | -
HTTPS to HTTP Insecure Transition in Form Post | Passive | MEDIUM | -
User Controllable JavaScript Event (XSS) | Passive | MEDIUM | -
Big Redirect Detected (Potential Sensitive Information Leak) | Passive | MEDIUM | -
Retrieved from Cache | Passive | MEDIUM | -
X-ChromeLogger-Data (XCOLD) Header Information Leak | Passive | MEDIUM | -
Cookie without SameSite Attribute | Passive | MEDIUM | -
CSP | Passive | MEDIUM | -
X-Debug-Token Information Leak | Passive | MEDIUM | -
Username Hash Found | Passive | MEDIUM | -
X-AspNet-Version Response Header | Passive | MEDIUM | -
PII Disclosure | Passive | MEDIUM | -
Script Passive Scan Rules | Passive | MEDIUM | -
Stats Passive Scan Rule | Passive | MEDIUM | -
Absence of Anti-CSRF Tokens | Passive | MEDIUM | -
Timestamp Disclosure | Passive | MEDIUM | -
Hash Disclosure | Passive | MEDIUM | -
Cross-Domain Misconfiguration | Passive | MEDIUM | -
Weak Authentication Method | Passive | OFF | -
Reverse Tabnabbing | Passive | MEDIUM | -
Modern Web Application | Passive | OFF | -
Authentication Request Identified | Passive | MEDIUM | -

## Sites

Number of Sites tree nodes actively scanned: 21

### https://tracking-protection.cdn.mozilla.net

HTTP Response Code | Number of Responses
--- | ---

#### No Authentication Statistics Found

Parameter Name | Type | Flags | Times Used | # Values
--- | --- | --- | --- | ---

### http://host.containers.internal:9990

HTTP Response Code | Number of Responses
--- | ---
404 Not Found | 16
200 OK | 10
302 Found | 11
401 Unauthorized | 4

#### No Authentication Statistics Found

Parameter Name | Type | Flags | Times Used | # Values
--- | --- | --- | --- | ---
Accept-Ranges | Header |  | 10 | 1
Access-Control-Allow-Credentials | Header |  | 2 | 1
Access-Control-Allow-Headers | Header |  | 6 | 3
Access-Control-Allow-Methods | Header |  | 4 | 2
Access-Control-Allow-Origin | Header |  | 2 | 1
Access-Control-Max-Age | Header |  | 2 | 1
Cache-Control | Header |  | 5 | 1
Connection | Header |  | 21 | 1
Content-Length | Header |  | 21 | 8
Content-Type | Header |  | 18 | 4
Date | Header |  | 21 | 5
Expires | Header |  | 5 | 3
Last-Modified | Header |  | 10 | 1
Location | Header |  | 3 | 1
Vary | Header |  | 2 | 1
WWW-Authenticate | Header |  | 4 | 4
X-Content-Type-Options | Header |  | 14 | 1
X-Frame-Options | Header |  | 14 | 1

### Alert Detail

Medium | Content Security Policy (CSP) Header Not Set
--- | ---
Description | Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
URL | http://host.containers.internal:9990/
Method | GET
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 298 bytes. | GET http://host.containers.internal:9990/ HTTP/1.1 host: host.containers.internal:9990 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 pragma: no-cache cache-control: no-cache Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 0 bytes. |
Response Header - size: 256 bytes. | HTTP/1.1 200 OK Connection: keep-alive Last-Modified: Tue, 29 Jul 2025 08:51:00 GMT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 519 Content-Type: text/html Accept-Ranges: bytes Date: Sat, 16 Aug 2025 20:56:28 GMT
Response Body - size: 519 bytes. | <!DOCTYPE html><html class="layout-pf layout-pf-fixed" lang=en><title>HAL Management Console</title><meta charset=utf-8><meta http-equiv=x-ua-compatible content="ie=edge"><meta name=viewport content="width=device-width, initial-scale=1"><link rel="icon shortcut" type=image/x-icon href=favicon.0cb7d388.ico><link rel=apple-touch-icon href=apple-touch-icon.da591cbc.png><link rel=stylesheet href=dev.d4c7acad.css media=screen><script type=module src=dev.58bbd86a.js></script><script src=hal.nocache.js></script><body>
URL | http://host.containers.internal:9990/console/index.html
Method | GET
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 253 bytes. | GET http://host.containers.internal:9990/console/index.html HTTP/1.1 host: host.containers.internal:9990 user-agent: pragma: no-cache cache-control: no-cache referer: http://host.containers.internal:9990/ Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 0 bytes. |
Response Header - size: 256 bytes. | HTTP/1.1 200 OK Connection: keep-alive Last-Modified: Tue, 29 Jul 2025 08:51:00 GMT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 519 Content-Type: text/html Accept-Ranges: bytes Date: Sat, 16 Aug 2025 20:56:28 GMT
Response Body - size: 519 bytes. | <!DOCTYPE html><html class="layout-pf layout-pf-fixed" lang=en><title>HAL Management Console</title><meta charset=utf-8><meta http-equiv=x-ua-compatible content="ie=edge"><meta name=viewport content="width=device-width, initial-scale=1"><link rel="icon shortcut" type=image/x-icon href=favicon.0cb7d388.ico><link rel=apple-touch-icon href=apple-touch-icon.da591cbc.png><link rel=stylesheet href=dev.d4c7acad.css media=screen><script type=module src=dev.58bbd86a.js></script><script src=hal.nocache.js></script><body>
URL | http://host.containers.internal:9990/management
Method | GET
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 360 bytes. | GET http://host.containers.internal:9990/management HTTP/1.1 host: host.containers.internal:9990 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: */* Accept-Language: en-US,en;q=0.5 Connection: keep-alive Referer: http://host.containers.internal:9990/console/index.html Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 0 bytes. |
Response Header - size: 385 bytes. | HTTP/1.1 401 Unauthorized Connection: keep-alive WWW-Authenticate: Digest realm="ManagementRealm", nonce="AAAAAQAACAyjhqtUgt+HhYsA/uRyT3Gosn0DQ3UBzn2LGvvB7GnfUX3y2eo=", opaque="00000000000000000000000000000000", algorithm=MD5, qop=auth X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Length: 77 Content-Type: text/html Date: Sat, 16 Aug 2025 20:56:35 GMT
Response Body - size: 77 bytes. | <html><head><title>Error</title></head><body>401 - Unauthorized</body></html>
URL | http://host.containers.internal:9990/oidc/wildfly-console
Method | GET
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 385 bytes. | GET http://host.containers.internal:9990/oidc/wildfly-console HTTP/1.1 host: host.containers.internal:9990 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: */* Accept-Language: en-US,en;q=0.5 Referer: http://host.containers.internal:9990/console/index.html Connection: keep-alive Priority: u=4 Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 0 bytes. |
Response Header - size: 132 bytes. | HTTP/1.1 404 Not Found Connection: keep-alive Content-Length: 74 Content-Type: text/html Date: Sat, 16 Aug 2025 20:56:36 GMT
Response Body - size: 74 bytes. | <html><head><title>Error</title></head><body>404 - Not Found</body></html>
URL | http://host.containers.internal:9990/robots.txt
Method | GET
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 197 bytes. | GET http://host.containers.internal:9990/robots.txt HTTP/1.1 host: host.containers.internal:9990 user-agent: pragma: no-cache cache-control: no-cache Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 0 bytes. |
Response Header - size: 132 bytes. | HTTP/1.1 404 Not Found Connection: keep-alive Content-Length: 74 Content-Type: text/html Date: Sat, 16 Aug 2025 20:56:28 GMT
Response Body - size: 74 bytes. | <html><head><title>Error</title></head><body>404 - Not Found</body></html>
URL | http://host.containers.internal:9990/sitemap.xml
Method | GET
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 198 bytes. | GET http://host.containers.internal:9990/sitemap.xml HTTP/1.1 host: host.containers.internal:9990 user-agent: pragma: no-cache cache-control: no-cache Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 0 bytes. |
Response Header - size: 132 bytes. | HTTP/1.1 404 Not Found Connection: keep-alive Content-Length: 74 Content-Type: text/html Date: Sat, 16 Aug 2025 20:56:28 GMT
Response Body - size: 74 bytes. | <html><head><title>Error</title></head><body>404 - Not Found</body></html>
URL | http://host.containers.internal:9990/management
Method | POST
Parameter |
Attack |
Evidence |
Other Info |
Show / hide Request and Response |
Request Header - size: 533 bytes. | POST http://host.containers.internal:9990/management HTTP/1.1 host: host.containers.internal:9990 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0 Accept: application/dmr-encoded Accept-Language: en-US,en;q=0.5 Referer: http://host.containers.internal:9990/console/index.html content-type: application/dmr-encoded x-management-client-name: HAL Content-Length: 252 Origin: http://host.containers.internal:9990 Connection: keep-alive Priority: u=4 Authorization: Basic YWRtaW46YWRtaW4=
Request Body - size: 252 bytes. | bwAAAAMACW9wZXJhdGlvbnMACWNvbXBvc2l0ZQAHYWRkcmVzc2wAAAAAAAVzdGVwc2wAAAACbwAAAAQAD2F0dHJpYnV0ZXMtb25seVoBAA9pbmNsdWRlLXJ1bnRpbWVaAQAJb3BlcmF0aW9ucwANcmVhZC1yZXNvdXJjZQAHYWRkcmVzc2wAAAAAbwAAAAMAB3ZlcmJvc2VaAQAJb3BlcmF0aW9ucwAGd2hvYW1pAAdhZGRyZXNzbAAAAAA=
Response Header - size: 744 bytes. | HTTP/1.1 401 Unauthorized Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Headers: WWW-Authenticate Access-Control-Allow-Headers: Authorization X-Frame-Options: SAMEORIGIN Date: Sat, 16 Aug 2025 20:56:36 GMT Connection: keep-alive Access-Control-Allow-Origin: http://host.containers.internal:9990 WWW-Authenticate: Digest realm="ManagementRealm", nonce="AAAAAgAACAzfA80wy4pl4TW7/mjh4Dnk+8bD58L71oTBXkafrFsntw9/qeo=", opaque="00000000000000000000000000000000", algorithm=MD5, qop=auth Vary: Origin Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Length: 77 Content-Type: text/html Access-Control-Allow-Methods: GET Access-Control-Allow-Methods: POST Access-Control-Max-Age: 3600
Response Body - size: 77 bytes. | <html><head><title>Error</title></head><body>401 - Unauthorized</body></html>
Instances | 7
Solution | Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header.
Reference | https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html https://www.w3.org/TR/CSP/ https://w3c.github.io/webappsec-csp/ https://web.dev/articles/csp https://caniuse.com/#feat=contentsecuritypolicy https://content-security-policy.com/
Tags | CWE-693 OWASP_2021_A05 OWASP_2017_A06 POLICY_QA_STD = POLICY_PENTEST =
CWE Id | 693
WASC Id | 15
Plugin Id | 10038

### Sequence Details

With the associated active scan results.