PT-2025-24818 · Redcap · Redcap

Published 2025-06-10 · Updated 2025-06-10 · CVE-2024-37396

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions REDCap version 13.1.9

Description A stored cross-site scripting (XSS) issue in the Calendar function allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the Notes field of a calendar event. This could lead to the execution of malicious scripts when the event is viewed.

Recommendations For REDCap version 13.1.9, update to version 14.2.1 or later to remediate this issue. As a temporary workaround, consider restricting access to the Calendar function or avoiding the use of the Notes field in calendar events until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-37396

Affected Products

Redcap

References · 6

• 🔥 https://trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396 · Exploit
• 🔥 https://trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt · Exploit
• https://osv.dev/vulnerability/CVE-2024-37396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37396 · Security Note
• https://evms.edu/research/resources_services/redcap/redcap_change_log · Note
• https://twitter.com/CVEnew/status/1932513002781385074 · Twitter Post