Analisis Kerentanan Web Menggunakan ZAP oleh Checkmarx pada Website FIKSI (Fakultas Ilmu Komputer dan Sistem Informasi) Universitas Kebangsaan Republik Indonesia

Abstract

This study aims to identify and analyze security vulnerabilities in faculty web applications using the Zed Attack Proxy (ZAP) automated tool developed by OWASP and now managed by Checkmarx. Using a descriptive quantitative approach, a scan was conducted on the public domain cdnjs.cloudflare.com which has a technical structure similar to the faculty web system. The scan results found four vulnerabilities, namely: use of a vulnerable JavaScript library (moment.js) (high risk), insecure Cross-Origin Resource Sharing (CORS) configuration (medium risk), suspicious comments in the code (informational risk), and inappropriate cache settings (informational risk). These findings are analyzed based on the OWASP Top 10 categories, and are complemented by mitigation recommendations for each risk. In addition, a visualization of the distribution of alerts is presented based on the level of risk and confidence. The results of this study emphasize the importance of routine scanning and manual validation in maintaining the security of higher education institution web applications.