CVE-2025-23110: XSS

Published Jan 10, 2025

Updated

An issue was discovered in REDCap 14.9.6. A Reflected cross-site scripting (XSS) vulnerability in the email-subject field exists while performing an upload of a CSV file containing a list of alert configurations. An attacker can send the victim a CSV file containing the XSS payload in the email-subject. Once the victim uploads the file, he automatically lands on a page to view the uploaded data. If the victim clicks on the email-subject value, it triggers the XSS payload.

Affected Software

2 affected components

REDCap REDCap

Vanderbilt REDCap=14.9.6

Event History

Jan 10, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-23110?

CVE-2025-23110 is considered a medium severity vulnerability due to its XSS nature.

How do I fix CVE-2025-23110?

To fix CVE-2025-23110, ensure you upgrade to a patched version of REDCap that addresses the XSS vulnerability.

What kind of vulnerability is CVE-2025-23110?

CVE-2025-23110 is a reflected cross-site scripting (XSS) vulnerability.

What software is affected by CVE-2025-23110?

CVE-2025-23110 affects REDCap version 14.9.6.

Can CVE-2025-23110 be exploited remotely?

Yes, an attacker can exploit CVE-2025-23110 remotely by sending a malicious CSV file to the victim.