CVE-2024-56311: CSRF
REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56311?
CVE-2024-56311 is considered a medium severity vulnerability due to its potential to facilitate a Cross-Site Request Forgery (CSRF) attack.
How do I fix CVE-2024-56311?
To fix CVE-2024-56311, users should upgrade their REDCap installation to a version higher than 14.9.6 to mitigate the vulnerability.
What impact does CVE-2024-56311 have on users?
CVE-2024-56311 allows attackers to log users out of their sessions by exploiting the Notes section of calendar events, disrupting user access.
Which versions of REDCap are affected by CVE-2024-56311?
REDCap versions up to and including 14.9.6 are affected by CVE-2024-56311.
Is CVE-2024-56311 a known vulnerability in REDCap?
Yes, CVE-2024-56311 is a recognized security flaw that has been documented for REDCap.