CVE-2019-5647

Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration

State: Published
Severity: 4.4 Medium
Published: Jan 22, 2020
Updated: Sep 17, 2024
Reserved: Jan 7, 2019

Description

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	rapid7

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
AppSpiderRapid7	3.8.213 through 3.8.213Affected

References

https://help.rapid7.com/appspiderenterprise/release-notes/?rid=3.8.215

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.