PT-2025-3274 · Redcap · Redcap

Published 2025-01-09 · Updated 2025-01-16 · CVE-2024-56377

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions REDCap version 14.9.6

Description A stored cross-site scripting (XSS) vulnerability in survey titles allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.

Recommendations For REDCap version 14.9.6, consider disabling the ability to inject scripts into the Survey Title field or Survey Instructions as a temporary workaround until a patch is available. Restrict access to the survey page to minimize the risk of exploitation. Avoid using the Survey Title field or Survey Instructions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56377

Affected Products

Redcap

References · 8

• 🔥 https://github.com/ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE-2024-56377/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-56377 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56377 · Vendor Advisory
• https://t.me/cvedetector/14946 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1877674074119291109 · Twitter Post
• https://t.me/cvenotify/107003 · Telegram Post
• https://evms.edu/research/resources_services/redcap/redcap_change_log · Note
• https://twitter.com/CVEnew/status/1877620716230815824 · Twitter Post