PT-2022-11545 · Redcap · Redcap

Published 2022-04-13 · Updated 2022-04-21 · CVE-2021-42136

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions REDCap versions prior to 11.4.0

Description A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.

Recommendations For versions prior to 11.4.0, update to version 11.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Missing Data Codes functionality to minimize the risk of exploitation. Avoid using the Missing Data Code value to store unvalidated user input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42136

Affected Products

Redcap

References · 9

• 🔥 https://exploit-db.com/exploits/50877 · Exploit
• 🔥 http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42136 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42136 · Vendor Advisory
• https://t.me/cvenotify/29064 · Telegram Post
• https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf · Note
• https://t.me/cvenotify/29261 · Telegram Post
• https://t.me/cibsecurity/40735 · Telegram Post
• https://project-redcap.org · Note