CVE-2022-24004: XSS

Published Jun 15, 2022

Updated

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messengerajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title (aka newtitle) field when editing an existing conversation. The payload executes in the browser of any conversation participant with the sidebar shown.

Affected Software

1 affected component

Vanderbilt REDCap=12.0.11

Event History

Jun 15, 2022

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

Description

Frequently Asked Questions

What is CVE-2022-24004?

CVE-2022-24004 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in REDCap 12.0.11.

How does CVE-2022-24004 affect REDCap?

CVE-2022-24004 allows any authenticated user to inject arbitrary code into the messenger title field when editing an existing conversation.

What is the severity of CVE-2022-24004?

The severity of CVE-2022-24004 is medium, with a CVSS score of 5.4.

How can I fix CVE-2022-24004?

To fix CVE-2022-24004, it is recommended to update REDCap to a version that is not affected by the vulnerability.

Where can I find more information about CVE-2022-24004?

You can find more information about CVE-2022-24004 in the references provided: https://labs.nettitude.com/blog/cve-2022-24004-cve-2022-24127-vanderbilt-redcap-stored-cross-site-scripting/ and https://www.evms.edu/research/resources_services/redcap/redcap_change_log/