ZAP plugin on Jenkins scan not showing all the findings (only High vulnerabilities are showing up in the report) compared to the ZAP automated scan in the local machine

[Sairam Nalluri]

Hi All,

I'm using ZAP plugin on Jenkins for automated scan and observed that ZAP plugin on Jenkins scan not showing all the findings (only High vulnerabilities are showing up in the report)  compared to the ZAP automated scan in the local machine. Please look in to the below information once and let me know if I'm missing anything here.

Thanks in Advance.

Regards,

Sairam

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Java Version : 1.8.0_73

Jenkins Version: 2.222.3

ZAP version : 2.9.0 (Installed on local machine:: Windows)

ZAP Jenkins Plugin Version: 1.1.0

• Jenkins and ZAP , both are running on the master 

Configuration:

Please see the below screenshot for reference to the Jenkins configuration:

I have created the ZAP + jenkins configuration and scanned http://demo.testfire.net/. The build is successful and report is generated.

However, only High severity(2 issues)  findings are shown in the Jenkins report. When the same application is scanned through ZAP local installation, it showing lot of other findings.

Jenkins Report: