CVE-2024-37394: XSS
A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious scripts when the dashboard is viewed. Users are recommended to update to version 14.2.1 or later to mitigate this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability severity of CVE-2024-37394?
CVE-2024-37394 has a medium severity level due to its potential for stored cross-site scripting attacks.
How can I mitigate CVE-2024-37394?
To mitigate CVE-2024-37394, upgrade to REDCap version 14.2.1 or later to prevent exploitation of the XSS vulnerability.
Who is affected by CVE-2024-37394?
Authenticated users of REDCap versions prior to 14.2.1 are affected by CVE-2024-37394.
What type of vulnerability is CVE-2024-37394?
CVE-2024-37394 is classified as a stored cross-site scripting (XSS) vulnerability.
What are the consequences of exploiting CVE-2024-37394?
Exploiting CVE-2024-37394 can allow attackers to execute arbitrary web scripts or HTML in the context of the affected user's session.