CVE-2022-24127: XSS
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/editprojectsettings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (apptitle) field when editing an existing project. The payload is then reflected within the title tag of the page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24127?
CVE-2022-24127 is classified as a medium severity vulnerability due to its potential for exploitation via stored cross-site scripting.
How do I fix CVE-2022-24127?
To fix CVE-2022-24127, upgrade REDCap to version 12.0.12 or later where this vulnerability has been patched.
Who is affected by CVE-2022-24127?
Anyone using REDCap version 12.0.11 who has project management permissions is at risk of CVE-2022-24127.
What kind of attack does CVE-2022-24127 enable?
CVE-2022-24127 enables stored cross-site scripting attacks where malicious scripts can be injected and executed in the context of a user's browser.
What can attackers achieve using CVE-2022-24127?
Attackers can leverage CVE-2022-24127 to execute arbitrary code in the user's browser, potentially leading to data theft or unauthorized actions.