Professional / Community 2024.2.1

Summary: PortSwigger released Burp Suite Professional/Community 2024.2.1 on 1 March 2024, adding API scanning that lets users upload an OpenAPI v3.0.x definition from a local file to seed a scan and view or configure the endpoints to be scanned. The release also brings Bambdas into the Logger capture filter, adds passive scan checks for CSP issues such as unsafe script permissions, clickjacking, form hijacking and incorrect syntax, and raises the minimum supported Java version from 17 to 21.
Key Takeaway: The new CSP checks surface clickjacking and form hijacking weaknesses in the scanner's passive pass, so findings your teams previously caught only through manual review can now appear in routine scans - and anyone launching Burp from the command line must move to Java 21 or later.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026