PT-2025-24817 · Redcap · Redcap

Published 2025-06-10 · Updated 2025-06-10 · CVE-2024-37395

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions REDCap version 13.1.9

Description A stored cross-site scripting (XSS) issue in the Public Survey function allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the Survey Title and Survey Instructions fields. This could be exploited by attackers to execute malicious scripts when the survey is accessed through its public link.

Recommendations Update to version 14.2.1 or later to fix this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37395

Affected Products

Redcap

References · 6

• 🔥 https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396 · Exploit
• 🔥 https://trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37395 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37395 · Vendor Advisory
• https://twitter.com/CVEnew/status/1932513001942495681 · Twitter Post
• https://evms.edu/research/resources_services/redcap/redcap_change_log · Note