+
+
+
+
+ | Medium (High) | Content Security Policy (CSP) Header Not Set |
+
+
+
+
+
+
+ | Description | Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files. |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/sitemap.xml |
+
+
+
+ | Method | GET |
+
+
+
+
+
+ | Instances | 3 |
+
+
+
+ | Solution | Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: "Content-Security-Policy" for Chrome 25+, Firefox 23+ and Safari 7+, "X-Content-Security-Policy" for Firefox 4.0+ and Internet Explorer 10+, and "X-WebKit-CSP" for Chrome 14+ and Safari 6+. |
+
+
+
+ | Reference | https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html http://www.w3.org/TR/CSP/ http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html http://www.html5rocks.com/en/tutorials/security/content-security-policy/ http://caniuse.com/#feat=contentsecuritypolicy http://content-security-policy.com/ |
+
+
+
+ | CWE Id | 16 |
+
+
+
+ | WASC Id | 15 |
+
+
+
+ | Source ID | 3 |
+
+
+
+
+
+
+
+
+ | Medium (Medium) | Proxy Disclosure |
+
+
+
+
+
+
+ | Description | 2 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine - A list of targets for an attack against the application. - Potential vulnerabilities on the proxy servers that service the application. - The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated. |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/sitemap.xml |
+
+
+
+ | Method | GET |
+
+
+
+ | Attack | TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method. |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Attack | TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method. |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/robots.txt |
+
+
+
+ | Method | GET |
+
+
+
+ | Attack | TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method. |
+
+
+
+
+
+ | Instances | 3 |
+
+
+
+ | Solution | Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server. Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing). Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages. Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers. |
+
+
+
+ | Other information | Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server: - Apache - Apache The following web/application server has been identified: - Apache/2.4.37 (centos) OpenSSL/1.1.1c |
+
+
+ |
+
+
+
+ | Reference | https://tools.ietf.org/html/rfc7231#section-5.1.2 |
+
+
+
+ | CWE Id | 200 |
+
+
+
+ | WASC Id | 45 |
+
+
+
+ | Source ID | 1 |
+
+
+
+
+
+
+
+
+ | Low (High) | Server Leaks Version Information via "Server" HTTP Response Header Field |
+
+
+
+
+
+
+ | Description | The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to. |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/sitemap.xml |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/robots.txt |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c |
+
+
+
+
+
+ | Instances | 4 |
+
+
+
+ | Solution | Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details. |
+
+
+
+ | Reference | http://httpd.apache.org/docs/current/mod/core.html#servertokens http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007 http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html |
+
+
+
+ | CWE Id | 200 |
+
+
+
+ | WASC Id | 13 |
+
+
+
+ | Source ID | 3 |
+
+
+
+
+
+
+
+
+ | Low (Medium) | X-Content-Type-Options Header Missing |
+
+
+
+
+
+
+ | Description | The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing. |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/robots.txt |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | X-Content-Type-Options |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | X-Content-Type-Options |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | X-Content-Type-Options |
+
+
+
+
+
+ | Instances | 3 |
+
+
+
+ | Solution | Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing. |
+
+
+
+ | Other information | This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. At "High" threshold this scan rule will not alert on client or server error responses. |
+
+
+ |
+
+
+
+ | Reference | http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx https://owasp.org/www-community/Security_Headers |
+
+
+
+ | CWE Id | 16 |
+
+
+
+ | WASC Id | 15 |
+
+
+
+ | Source ID | 3 |
+
+
+
+
+
+
+
+
+ | Low (Medium) | Insufficient Site Isolation Against Spectre Vulnerability |
+
+
+
+
+
+
+ | Description | Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS). |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Embedder-Policy |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Opener-Policy |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Opener-Policy |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/robots.txt |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Resource-Policy |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Resource-Policy |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Embedder-Policy |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Parameter | Cross-Origin-Resource-Policy |
+
+
+
+
+
+ | Instances | 7 |
+
+
+
+ | Solution | Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents. If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy). |
+
+
+
+ | Reference | https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy |
+
+
+
+ | CWE Id | 16 |
+
+
+
+ | WASC Id | 14 |
+
+
+
+ | Source ID | 3 |
+
+
+
+
+
+
+
+
+ | Informational (Medium) | Modern Web Application |
+
+
+
+
+
+
+ | Description | The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one. |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | <script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script> |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | <script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script> |
+
+
+
+
+
+ | Instances | 2 |
+
+
+
+ | Solution | This is an informational alert and so no changes are required. |
+
+
+
+ | Other information | No links have been found while there are scripts, which is an indication that this is a modern web application. |
+
+
+ |
+
+
+
+ | Reference | |
+
+
+
+ | Source ID | 3 |
+
+
+
+
+
+
+
+
+ | Informational (Medium) | Non-Storable Content |
+
+
+
+
+
+
+ | Description | The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance. |
+
+
+ |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | no-store |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/ |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | no-store |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/sitemap.xml |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | no-store |
+
+
+
+
+
+ | URL | https://wmi.plannaplan.pl/robots.txt |
+
+
+
+ | Method | GET |
+
+
+
+ | Evidence | no-store |
+
+
+
+
+
+ | Instances | 4 |
+
+
+
+ | Solution | The content may be marked as storable by ensuring that the following conditions are satisfied: The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable) The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood) The "no-store" cache directive must not appear in the request or response header fields For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives) In addition to the conditions above, at least one of the following conditions must also be satisfied by the response: It must contain an "Expires" header field It must contain a "max-age" response directive For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive It must contain a "Cache Control Extension" that allows it to be cached It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501). |
+
+
+
+ | Reference | https://tools.ietf.org/html/rfc7234 https://tools.ietf.org/html/rfc7231 http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234) |
+
+
+
+ | CWE Id | 524 |
+
+
+
+ | WASC Id | 13 |
+
+
+
+ | Source ID | 3 |
+
+
+
+
+
+ZAP Scanning Report
+
+