CVE-2020-26713: XSS
REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26713?
CVE-2020-26713 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2020-26713?
To mitigate CVE-2020-26713, update REDCap to version 10.3.5 or later, which addresses the XSS vulnerability.
What impact does CVE-2020-26713 have on affected systems?
Exploiting CVE-2020-26713 allows attackers to execute malicious scripts in the context of user sessions, risking exposure of sensitive information.
Which versions of REDCap are affected by CVE-2020-26713?
CVE-2020-26713 affects REDCap versions 10.0.20 and 10.3.4.
What is the nature of the vulnerability in CVE-2020-26713?
CVE-2020-26713 is a reflected XSS vulnerability that arises from unsanitized user input being returned in responses.