Rapid7 AppSpider Pro Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Rapid7 AppSpider Pro versions prior to 7.5.018. The issue arises in the 'ScanName' field, where the application typically restricts special characters. However, this limitation can be circumvented by directly editing the configuration file. As a result, malicious scripts can be injected and stored within the application.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to Rapid7 AppSpider Pro version 7.5.018 or later to address this vulnerability.