CVE-2025-11195
Rapid7 AppSpider Project Name Validation Bypass
Vexday Risk Score
8Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 3.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
30 sep 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Rapid7 · AppSpider Pro¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →