Acunetix 360 On-Demand

This update includes changes to internal scan agents. The internal scan agent’s current version is 2.0.2.135.

IMPROVEMENTS

• Added a condition for team members when sending an email notification.
• Added a condition when sending an email notification for Out-of-Date Technologies to customers.
• Improved the importing of RAML files includes other files.
• Updated the Freshservice integration not to send a user agent header.
• Improved the API responses by adding model mapping for AuthenticationProfileOption and AuthenticationProfileId.
• Added a message to the Jira integration to show that the integration is created successfully.
• Added an error message for invalid component value of newly created Jira integration.
• Improved the pop-up message that warns users that they share the report with a person from the outside of the organization.
• Updated an explanation on strong password recommendations on the Change Password page.

FIXES

• Fixed an issue that prevented keywords from being refreshed when the login required URL is changed on the Login Verification window.
• Fixed a misspelled word on the GraphQL Introspection window.
• Fixed a bug that prevented each website using its own default scan policy when a scheduled group scan is launched.
• Fixed the issue where the client-side cookies were not excluded correctly.
• Fixed an issue with latestVulnerabilityStatePointId values that return errors on the Issues/To Do and Issues/All issues.
• Fixed an issue that shows a two-factor authentication warning message for provisioned team members with Okta.
• Fixed an information message that uses the word “notification” although the message is about the integration.
• Fixed an issue in DefectDojo, YouTrack, and TFS integration that refreshes the New Integration page when a custom field is added and the user selects the Create Sample Issue button.
• Fixed an issue that shows extra leading white space in the console of the Website page.
• Fixed the issue with the Missing XSS protection Header in the Out-of-Scope link.
• Fixed the more information link that does not open the correct page for the Custom URL Rewrite.
• Fixed the more information link that does not have a related link on the Scan Scope tab of New Scan Screen.
• Fixed the more information link that does not open any page.
• Fixed an explanation appearing on the AcuSensor page.
• Fixed a weak password error message thrown by Acunetix 360 when a user is synchronized using Okta.
• Fix the issue that prevents the built-in scan policies from being updated when there is a new update for the On-Demand version.
• [INTERNAL AGENTS] Fixed a request payload when the Agent sends big scan data.
• [INTERNAL AGENTS] Fixed OAuth2 verification that fails due to the OTP settings model being null.
• [INTERNAL AGENTS] Fixed the scan error on completion issue because of crossthread error by moving to ConcurrentDictionary.

The internal agent’s current version is 2.0.2.131.

NEW SECURITY CHECKS

• Added Out of Band Code Evaluation (Log4j) a.k.a. Log4Shell detection support.

The internal agent’s current version is 2.0.2.128.

IMPROVEMENTS

• Added a behavior that the system sets the default policies of a website group to a website for the Scheduled Group Scans and Group Scans. The system sets the default policies only if users select the default policies on the General Settings page and then assign these policies to a website group on the policies page.
• Added an information message for updating the agent’s status.

FIXES

• Fixed an issue that set the wrong default scan and report for the Scheduled Group Scan and Group Scan if there is a scan profile.
• Fixed an issue that prevented a user from editing the default scan policy.
• Fixed an issue that removes the client certificate from the Form Authentication page if the related scan profile is updated.
• Fixed an issue that occured when the same vulnerability was sent to Jira’s endpoint more than once.
• Fixed a mismatching type issue on /scanprofiles/list API response model.

FEATURES

• Introduced the default scan and report policy, so you can set default policies for your team.

IMPROVEMENTS

• Added the tagging filtering to the Scan Profiles.
• Added the license error to the scans that were scheduled by users whose licenses are expired.
• Added the fixed confirmation date to the issues API endpoint so that you can better track your team’s remediation efforts.
• Added null check for application names during comparison with the vulnerability database.

FIXES

• Fixed the first seen date issue that appeared differently on the user interface and the scan report.
• Fixed the Url Rewrite Excluded Links API call by adding null response back to that call’s responses.
• Fixed a bug that prevents serialized integration information from being decrypted in some issues.
• Fixed an issue that displays the mistaken path in the trend matrix reports when different paths are scanned.
• Fixed a bug returning the 500 Error when an issue is updated.

This update includes changes to Internal Agents. The internal agent’s current version is 2.0.2.125.

IMPROVEMENTS

• Improved the Login Banner Warning feature so that users cannot access any resources on Acunetix 360 until they select the Accept, Continue button.
• Add the Environment field to the DefectDojo integration.
• Added the Export to CSV button on the Manage Members page so that you can download all your team members to your environment.

FIXES

• Fixed a bug that prevented the scan profile of a deleted website from being removed. Now, when users delete a website, the related scans, including scan profile, are also deleted.
• Fixed an issue that prevent the scan from being canceled.
• Fixed the missing ScanTaskProfile field by adding it back to scan API call responses.
• Fixed a bug that prevents members and teams from being deleted if they have been assigned to website groups.
• Fixed a bug that allows the API member edit endpoint which accepts less than 15 characters for the administrator’s password.
• Changed the permission to view reports from Add/Edit Scan to the View Report.
• [INTERNAL AGENTS] Changed Agent request time interval to 60 seconds.
• [INTERNAL AGENTS] Fixed a bug that prevents an agent from scanning a new website if the previous scan was canceled.