Stored Cross-Site Scripting Vulnerability in REDCap by Vanderbilt University
CVE-2024-37394

5.4MEDIUM

Key Information:

Vendor

Vanderbilt University

Status
REDCap
Vendor
CVE Published:
10 June 2025

What is CVE-2024-37394?

A vulnerability exists within REDCap version 13.1.9, allowing authenticated users to exploit stored cross-site scripting (XSS) by injecting malicious scripts into the 'Dashboard title' and 'Dashboard content' fields. This can result in executing harmful code when dashboards are accessed, potentially compromising sensitive information or user accounts. Users should promptly update to version 14.2.1 or above to remediate this security risk.

References

https://www.evms.edu/research/resources_services/redcap/r...
https://www.trustwave.com/en-us/resources/blogs/spiderlab...
https://www.trustwave.com/hubfs/Web/Library/Advisories_tx...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.