ZAP Latest Version Plugin ID 10000

[j2 c]

Hello

The Plugin ID 10000 have different  descriptions and risk levels.  Is this normal or should each have its own Plugin IDs.  Both are the same, but then not the same.  It seems that each should have different IDs.

[Simon Bennetts]

We do have many rules that raise different alerts for subtly different reasons.

However they should all have unique alert references, e.g. see https://www.zaproxy.org/docs/alerts/3/

It looks like this one slipped through the net, partly because its defined in a script: https://github.com/zaproxy/community-scripts/blob/main/httpsender/Alert%20on%20HTTP%20Response%20Code%20Errors.js

FYI it is included in the API Policy so you will not have had to install any scripts in order to see it.

I've raised an issue for this: #9273

Thanks for reporting this problem,

Simon