CVE-2024-56313

MEDIUM EPSS 30.5%

Published Dec 22, 20241y ago · Modified Jun 17, 20261w ago

5.4 CVSS 3.1

Medium

Published Dec 22, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

A stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap through 14.9.6 allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the crafted payload is executed, potentially enabling the execution of arbitrary web scripts.

CVSS Details

Base Score

5.4

Exploitability

2.3

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

30.5% percentile

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
vanderbilt	redcap	*	≤14.9.6

References 2

github.com https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap

ExploitThird Party Advisory
evms.edu https://www.evms.edu/research/resources_services/redcap/redcap_change_log/

Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.