Releases

Security

• Fix CVE-2022-29248.

Improvements

• Add SSO configuration option for Microsoft Graph tenant ID.
• Do not show the assigned icon for a manager when the assessment status is 'Completed'.

New Summary Tables

Two new components are available to render summary tables:

Requires Attention

The default value for the MAIL_ENCRYPTION setting has changed from tls to the more secure value ssl. Set the value of MAIL_ENCRYPTION to tls if your SMTP server makes use of STARTTLS. See the documentation for more information.

Continuous Assessments

A new status 'Continuous' has been added for assessments that are always open and have no specific end date and phases. This status is helpful in enabling bug bounty style assessments.

Bugfixes

• Fixed an issue where file uploads not related to markdown fields were broken.
• Fixed an issue where changing the client of an assessment would cause some tasks and notifications to throw an exception.

Webhooks

This release brings webhooks to Reporter for extra flexibility and extensibility! Webhooks are almost always faster than polling the API, and require less work on your end.

The following events are supported assessment:created, assessment:updated, finding:created, finding:updated and finding:published.

New Markdown editor

This release dramatically improves the readability when writing your findings in the new context-aware editor of Reporter. The editor has many other improvements, such as a side-by-side feature that automatically updates the preview when writing your content.

Automatic template suggestion logic

Previously, when a researcher selected a template to create a finding, the 'Template Suggestions-tab' showed templates attached to that specific section in the assessment type used. However, this relied on an admin user going over the sections of each assessment type and manually attaching templates. 

Comment improvements

• Finding comments are now private by default.
• You can now reply to top-level finding comments.
• The comment reply form now appears where the posted comment will, at the bottom of the chain of replies.
• Posting a new comment, retest, or retest request now reloads the page and takes you to that event.
• The background colors of all finding events and finding event forms now change dynamically by if the edit form is open, whether Is private is toggled and whether review status is set to published

Documentation is now available in Reporter

The Reporter documentation has been added to the Reporter installation and is available to all admins and researchers from the main menu. In addition, all pages in Reporter now have a button that takes you directly to the most relevant section of the documentation for that page.

Improved targets overview

The target overview has been restyled for a better presentation of assessments with many targets. Filtering, searching and CSV export functionality has also been added.