Critical Severity in ZAP alerts

[Antero Silva]

Hi,

Currently ZAP supports the severities addressed in the following url https://www.zaproxy.org/docs/desktop/start/features/alerts/ 

Is ZAP considering also supporting the new Critical Severity addresses by OWASP when there is a High impact and Likelihood

https://owasp.org/www-community/OWASP_Risk_Rating_Methodology 

Regards,

Antero

[kingthorin+owaspzap]

ZAP doesn't have access to all of the contextual data to calculate Risk.

[kingthorin+owaspzap]

To be clear, ZAP does call the field on the Alerts "Risk" but in reality it's more like "Severity".

No there isn't a way to "add" another, you can however:

- Add an alert tag.

- Set the confidence to "Confirmed".

[Antero Silva]

Hi,

Sorry but i'm not getting it. Alerts are being raised by ZAP components such as active scanning. Each scanner/rule is determining the severity of the alert. therefore it should be possible to add a new severity call Critical right ?

[kingthorin+owaspzap]

Logically it's is "Possible" but the number of things that it would impact makes it VERY impractical.

[Simon Bennetts]

I guess we _could_ add a new level, but I cant see us changing any of the rules to support it directly.

Instead it would be like "False Positive" which is only set manually, via the API or alert filters.

Would that be useful to anyone?

Cheers,

Simon

[Antero Silva]

Hi Simon,

Yes it would be useful. 

Regards,

Antero