CVE-2019-5647

MEDIUM

Rapid7 AppSpider < 3.8.213 - Insufficient Session Expiration in Chrome Plugin

Title source: llm

Description

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.

References (1)

Core 1

Core References

Release Notes, Vendor Advisory x_refsource_confirm

https://help.rapid7.com/appspiderenterprise/release-notes/?rid=3.8.215

Scores

CVSS v3 4.4

EPSS 0.0034

EPSS Percentile 25.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Details

CWE

CWE-613

Status published

Products (1)

rapid7/appspider < 3.8.213

Published Jan 22, 2020

Tracked Since Feb 18, 2026