CVE-2024-56313: XSS
A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56313?
The severity of CVE-2024-56313 is high due to its potential to allow authenticated users to execute malicious scripts via stored cross-site scripting.
How do I fix CVE-2024-56313?
To fix CVE-2024-56313, upgrade to a version of REDCap that is newer than 14.9.6 where the vulnerability is patched.
Who is affected by CVE-2024-56313?
Authenticated users of REDCap versions up to and including 14.9.6 can be affected by CVE-2024-56313.
What is the impact of CVE-2024-56313?
The impact of CVE-2024-56313 allows attackers to inject and execute malicious scripts in the Notes field of calendar events, potentially leading to data compromise.
Is user input validated in CVE-2024-56313?
In the case of CVE-2024-56313, user input in the Notes field is not adequately validated, allowing for the injection of scripts.