SQL Injection Vulnerability in Vanderbilt REDCap Software
CVE-2023-38825

6.5MEDIUM

Key Information:

Vendor

Vanderbilt University

Status
Redcap
Vendor
CVE Published:
21 March 2024

What is CVE-2023-38825?

A SQL injection vulnerability exists in Vanderbilt REDCap, affecting versions prior to 13.8.0. This weakness allows a remote attacker to exploit the password reset mechanism located in the MyCapMobileApp/update.php file, potentially accessing sensitive information. Such attacks could lead to unauthorized exposure of critical user data, making it essential for organizations using this platform to implement immediate mitigations and upgrade to the latest version to safeguard their systems.

References

https://www.project-redcap.org/
https://github.com/ntrampham/REDCap

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.