ZAP API Scan Report
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Download the ZAP report from the linked GitHub Actions run and review the alerts for the listed API endpoints, including /actuator/health and /v3/api-docs. Trace each alert to the relevant application or deployment configuration; done means the reported findings are addressed and a follow-up scan confirms the results.
Written by the indexing model from the issue text.
Description
- Site: https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca
New Alerts- Spring Actuator Information Leak [40042] total: 1:
- Cookie with SameSite Attribute None [10054] total: 6:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
- Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 1:
- Unexpected Content-Type was returned [100001] total: 4:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/
- Non-Storable Content [10049] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
- Session Management Response Identified [10112] total: 7:
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo
- https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs
- ..
View the following link to download the report.
RunnerID:14367365318
- Dominant language
- Java
- Stars
- 4
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from bcgov/EDUC-SOAM-API
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 25/100
bcgov/EDUC-SOAM-API#104 · 2 comments ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 45/100
bcgov/EDUC-SOAM-API#103 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
bcgov/EDUC-SOAM-API#102 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 35/100
bcgov/EDUC-SOAM-API#101 ·
-
ZAP API Scan ReportOpen
Difficulty 4/5 3-5 days Newbie friendliness 25/100
bcgov/EDUC-SOAM-API#92 ·
All issues in bcgov/EDUC-SOAM-API
Similar issues
-
[Bug] [Go] Ack returns nil when the server answers with a non-OK statusPossibly taken @leizhiyuan claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
apache/rocketmq-clients#1465 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
pdfium-drift
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Stirling-Tools/JPDFium#188 ·
Maintainers usually reply within 1 day
-
security
Difficulty 1/5 Under an hour Newbie friendliness 70/100
IBM/ibm-quarkus-ai-langchain4j-workshop#160 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
openremote/openremote#3487 · 1 comment ·