CVE-2019-5647: RAPID7 Appspider

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacking attempts easier, since the user could believe a session was closed when it was not. This issue affects Rapid7 AppSpider version 3.8.213 and prior versions, and is fixed in version 3.8.215.

Affected products

• RAPID7 Appspider: up to and including 3.8.213

Published 2020-01-22. Last modified 2026-06-17.