Stored XSS Vulnerability in REDCap Messenger Feature

CVE-2024-56376

What is CVE-2024-56376?

A stored cross-site scripting vulnerability exists in the built-in messenger feature of REDCap version 14.9.6. This issue allows authenticated users to inject malicious scripts into the message field. Upon clicking the received message, the injected payload is executed, which may allow for the execution of arbitrary web scripts, potentially compromising the security of user interactions and data integrity.

References