PT-2022-16406 · Redcap · Redcap

Published 2022-06-15 · Updated 2022-06-24 · CVE-2022-24004

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions REDCap version 12.0.11

Description A Stored Cross-Site Scripting issue was discovered in the messenger ajax.php file. This issue allows any authenticated user to inject arbitrary code into the new title field when editing an existing conversation. The payload executes in the browser of any conversation participant with the sidebar shown.

Recommendations For REDCap version 12.0.11, consider disabling the editing functionality of conversation titles until a patch is available to prevent exploitation of this issue. Restrict access to the messenger ajax.php file to minimize the risk of arbitrary code injection. Avoid using the new title field in the affected messenger functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24004

Affected Products

Redcap

References · 5

• 🔥 https://labs.nettitude.com/blog/cve-2022-24004-cve-2022-24127-vanderbilt-redcap-stored-cross-site-scripting · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24004 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24004 · Vendor Advisory
• https://evms.edu/research/resources_services/redcap/redcap_change_log · Vendor Advisory
• https://t.me/pentestingnews/24513 · Telegram Post