CVE-2024-56377

A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload (which has been injected into all survey fields) is executed, potentially enabling the execution of arbitrary web scripts.

Affected

Vanderbilt · REDCap

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2025-01-09

Updated

2025-01-10

Proof-of-concept exploits (1)

• ping-oui-no/Vulnerability-Research-CVESS/blob/main/RedCap/CVE-2024-56377/README.md2★ · 2025-01-13

Security advisories

• https://www.evms.edu/research/resources_services/redcap/redcap_change_log

References

• CVE Record
• NVD entry

Related

• CVE-2024-56376