Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them outside the application in affected versions. This vulnerability was remediated in version 7.5.021 of the product.
References
| Link | Resource |
|---|---|
| https://docs.rapid7.com/insight/releasenotes-2025sep/#application-security-insightappsec-and-appspider | Vendor Advisory |
Configurations
History
08 Oct 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Rapid7
Rapid7 appspider Pro |
|
| References | () https://docs.rapid7.com/insight/releasenotes-2025sep/#application-security-insightappsec-and-appspider - Vendor Advisory | |
| CPE | cpe:2.3:a:rapid7:appspider_pro:*:*:*:*:*:*:*:* |
30 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-30 18:15
Updated : 2025-10-08 14:15
NVD link : CVE-2025-11195
Mitre link : CVE-2025-11195
CVE.ORG link : CVE-2025-11195
JSON object : View
Products Affected
rapid7
- appspider_pro