Qualys WAS Engine 8.20 Released

Qualys Web Application Scanning Engine 8.20 has been released to all Qualys platforms including private cloud platforms. This release is part of our ongoing effort to continuously improve the scanning engine in Qualys Web Application Scanning.

This update includes the following changes:

• Option to configure custom error page with improvement for response codes 502 and 504 in QID 150042
• Fixed Authorization header during testing, particularly for no-authentication test phases to avoid false negatives
• Fixed Swagger related parsing due to single quote character
• Fixed Open redirect crawling during test phase
• Fixed crawling to continue if the starting URL response is 400 or 403 and configured via proxy
• Fixed empty lines that were reported in 150020
• Fixed payload reporting for QID 150004 to have full URL with payload
• Fixed false positive for IG 150505 to avoid reporting when client certificate is not configured in scan

Additional QIDs released:

• QID 150536 Detection for JWT token in Authorization header using “none” algorithm
• QID 150537 Detection for JWT token in Authorization header uses symmetric algorithm HS256
• QID 150528 Detection for too many 4xx responses during crawl phase
• QID 150546 Detection for starting URL response code and report in separate IG along with response body
• QID 150535 Report IG for links responding with Content-Type application/octet-stream
• QID 150545 Detect and report external facing (out of scope/domain) JavaScript Libraries
• QID 150564 WordPress uDraw Plugin : Arbitrary File Read Vulnerability (CVE-2022-0656)
• QID 150563 Webmin Authenticated Command Injection Vulnerability (CVE-2022-36446)
• QID 150560 WordPress WP-DBManager Plugin: Authenticated Remote Command Execution Vulnerability (CVE-2022-2354)
• QID 150559 Atlassian Jira Server and Data Center Multiple Servlet Filter Vulnerabilities(JRASERVER-73897)
• QID 150558 PHP Heap Buffer Overflow Vulnerability (CVE-2022-31627)
• QID 150557 Apache Spark Shell Command Injection Vulnerability (CVE-2022-33891)
• QID 150556 Atlassian Confluence Server and Data Center : Questions for Confluence App – Hardcoded Credentials (CVE-2022-26138)
• QID 150555 Oracle WebLogic Server Multiple Vulnerabilities (CPUJUL2022)
• QID 150554 WordPress WP Maintenance Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2022-30536)

As always, if you encounter any problems in your WAS scans, please open a support ticket by selecting Help > Contact Support while logged into the platform. Feel free to post a question on Qualys Community as well.

Happy Scanning.