CVE-2024-37395: XSS
A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by attackers to execute malicious scripts when the survey is accessed through its public link. It is advised to update to version 14.2.1 or later to fix this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37395?
CVE-2024-37395 is classified as a medium severity stored cross-site scripting (XSS) vulnerability.
How does CVE-2024-37395 affect REDCap?
CVE-2024-37395 allows authenticated users to inject and execute arbitrary web scripts or HTML via the 'Survey Title' and 'Survey Instructions' fields.
How do I fix CVE-2024-37395?
To fix CVE-2024-37395, upgrade your REDCap installation to version 14.2.1 or later.
Who can exploit CVE-2024-37395?
CVE-2024-37395 can be exploited by authenticated users with access to the Public Survey function.
What steps should I take if I am using an affected version of REDCap?
If using an affected version of REDCap, you should promptly update to the latest version to mitigate the risk of CVE-2024-37395.