CVE-2020-27358: Medium severity redcap (research electronic data capture) vulnerability
An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the threadid parameter in the request to the endpoint Messenger/messengerdownloadcsv.php?title=Hey&threadid={THREADID}.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-27358?
CVE-2020-27358 has a high severity rating due to its potential for unauthorized access to user conversation threads.
How do I fix CVE-2020-27358?
To fix CVE-2020-27358, upgrade your REDCap installation to version 10.0 or later.
Who is affected by CVE-2020-27358?
Users of REDCap versions 8.11.6 through 9.x before 10 are affected by CVE-2020-27358.
What type of vulnerability is CVE-2020-27358?
CVE-2020-27358 is a privilege escalation vulnerability allowing non-privileged users to export conversation threads.
What is the main issue with CVE-2020-27358?
The main issue with CVE-2020-27358 is that it allows unauthorized access to another user's conversation threads by manipulating the thread_id parameter.