Read the docs
TI-2019-04009 Aliases CVE-2019-5647GHSA-4qpq-v2q4-wj9r

Rapid7 AppSpider Chrome Plugin Insufficient Session Expiration

Priority LOW 31CWE-613Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-613.

Summary

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.

Why it matters now

EPSS 0.00336 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rapid7AppSpider3.8.213 – 3.8.213—No fix listedCNA
  • AppSpider VendorRapid7 Affected 3.8.213 – 3.8.213 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rapid7:appspider:*:*:*:*:enterprise:chrome:*:*up to 3.8.213VulnerableRapid7
  • cpe:2.3:a:rapid7:appspider:*:*:*:*:enterprise:chrome:*:* Versions up to 3.8.213 Vulnerable ·Rapid7

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5647
  2. 2026-10-03 Alias added: GHSA-4qpq-v2q4-wj9r

References

Advisory 1

  • TI-2020-05951 Code Injection in Rapid7 AppSpider Pro Installer CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences