bcgov / bcgov/jag-ccd

ZAP Scan Report - ProcessResults API

Open
#151 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
0
Forks
2
PR merge metrics
No merged PRs in 30d

Description

- Site: [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port)
- **Application Error Disclosure** [90022] total: 1:
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port)
- **Cookie with SameSite Attribute None** [10054] total: 2:
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL)
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port)
- **Unexpected Content-Type was returned** [100001] total: 2:
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL)
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port)
- **Non-Storable Content** [10049] total: 2:
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL)
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca:443/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults/CCD_Source_ProcessResults_ws_provider_ProcessResults_Port)
- **WSDL File Detection** [90030] total: 1:
- [https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL](https://jag-ccd-1-1-52e74e-dev.apps.silver.devops.gov.bc.ca/ws/CCD.Source.ProcessResults.ws.provider:ProcessResults?WSDL)

View the [following link](https://github.com/bcgov/jag-ccd/actions/runs/3489972261) to download the report.
RunnerID:3489972261

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the ZAP report from GitHub Actions run 3489972261 and inspect the ProcessResults WSDL and service endpoint named in the findings. Determine which reported server errors, application disclosure, cookie, content-type, and WSDL alerts are actionable, then rerun the scan to confirm the listed alerts are resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.