CVE-2025-11195
Rapid7 AppSpider Project Name Validation Bypass
Vexday Risk Score
8Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 3.3EPSS 0.1%KEV nãoPoC —Patch —
Ciclo de vida
30 set 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Rapid7 · AppSpider ProQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →