Cross-Site Request Forgery Vulnerability in REDCap Calendar Events

CVE-2024-56311

What is CVE-2024-56311?

REDCap, a widely used secure web application for building and managing online surveys and databases, has a significant security vulnerability related to the Notes section of calendar events. This issue allows an attacker to exploit the absence of Cross-Site Request Forgery (CSRF) protections on the logout functionality. When a user accesses the notes of a calendar event, the attack can trigger a logout request, leading to the unintended termination of their session. Consequently, this flaw poses a risk of unauthorized actions being executed without user consent, emphasizing the need for robust security measures to safeguard sensitive user sessions.

References