What's new in HCL AppScan® Enterprise

New in HCL AppScan® Enterprise 10.8.0

• Downloads update:
  • Starting with AppScan Enterprise 10.8.0, downloads are available only through the My HCLSoftware (MHS) portal.
• Licensing update:
  • My HCLSoftware (MHS) portal has replaced the FlexNet Operations (FNO) portal for licensing management.
  • FNO is now decommissioned and will no longer be supported.
  • End of Support (EOS): AppScan versions 10.6.0 and earlier will reach EOS by June 2025. Upgrade to the latest version to maintain support and access new features.
  • Video tutorial for setting up the license:
    • How to configure licensing in AppScan Enterprise via MHS
• New SCA scanner:
  • A new SCA scanner has been introduced on the monitor page. This scanner supports SCA XML files generated from AppScan on Cloud.
• Custom script scans:
  • AppScan Enterprise now supports custom Java scripts via AppScan Standard.
  • These scripts enable dynamic behavior by executing custom code for each HTTP request and response.
• Postman collection URL support for scans:
  • Scans can now be created and executed using a Postman collection URL from AppScan Standard. When the Postman collection is updated, rescanning will automatically fetch the latest contents from the URL, ensuring the most recent API changes are included in the scan.
  • Custom scripts can now be executed before sending a request or after receiving a response, allowing fine-tuned control over scan behavior.
• Activity log REST API:
  • A new activity log REST API (GET /activitylog/{dateRange}) is now available in the activitylog section of the AppScan Enterprise REST APIs page. You can retrieve activity details within a specified date range.
• Improved CWE mapping in security reports:
  • Security reports generated from the monitor tab, including DAST security reports, now display multiple CWE details alongside the primary CWE for each issue type.
  • This enhancement provides a broader security perspective, helping you assess vulnerabilities more effectively.
• CVSS vector display in API response:
  • The API GET/issues/{issueId}/application/{appId} now returns the CVSS vector for reported issues, enhancing risk assessment and prioritization.
• Accessibility enhancements:
  • AppScan Enterprise now includes enhancements aligned with Web Content Accessibility Guidelines (WCAG), improving user accessibility.

IAST agent updates

IAST agents have been upgraded to newer versions:

APAR fix list

The following Authorized Program Analysis Reports (APARs) were fixed:

Fixes and security updates

• attAppMetricsDataExposed - Application Metrics endpoint exposed
• attWordPressPluginXSSCVE20237246 - WordPress Plugin Cross-Site Scripting CVE20237246
• attAtlassianConfluenceBrokenAccessCVE202322515 - Atlassian Confluence Broken Access CVE 2023 22515
• SriValidation - Validation for SRI integrity check
• CSP Rules - Reworked CSP evaluation, resulting in detection of 17 new Content-Security-Policy issues
• Vulnerable component database updated to version 1.6

This release's complete list of fixes, updates, and RFEs is listed here.

Changed in this release

Removed in this release

Upcoming changes