Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration
CVE-2019-5647

4.4MEDIUM

Key Information:

Vendor

Rapid7

Status
Appspider
Vendor
CVE Published:
22 January 2020

What is CVE-2019-5647?

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.

Affected Version(s)

AppSpider 3.8.213

References

https://help.rapid7.com/appspiderenterprise/release-notes...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-5647 : Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration