CVE-2024-56314: XSS
A stored cross-site scripting (XSS) vulnerability in the Project name of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the project name to access it, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56314?
CVE-2024-56314 is considered a high-severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2024-56314?
To fix CVE-2024-56314, update REDCap to the latest version beyond 14.9.6 where the vulnerability is patched.
What impact does CVE-2024-56314 have on REDCap?
CVE-2024-56314 allows authenticated users to inject and execute malicious scripts via the project name field.
Who is affected by CVE-2024-56314?
Authenticated users of REDCap versions up to and including 14.9.6 are affected by CVE-2024-56314.
What types of attacks can CVE-2024-56314 lead to?
CVE-2024-56314 can lead to user session hijacking, data theft, and other malicious actions performed through executed scripts.