Embed Notice

Today in What Grinds my Gears:
When a ZAP scan flags a "high severity, high confidence" issue based on literally nothing.

ZAP: sends a request with a hinky query string
Server: ignores all query strings
ZAP: OMG BLIND SERVER SIDE INJECTION INTO A NONEXISTENT TEMPLATE ENGINE!!!!!11one

As in previous "What Grinds my Gears" I really don't get why these scanning tools assign ridiculously high confidence values to issues where there's no evidence the vulnerable component exists.