CVE-2024-37396

Exploit

EPSS 0.32%
Published 10.06.2025 00:00:00
Last modified 16.06.2025 15:12:55
Source cve@mitre.org
CVE-Watchlists
Login
Open
Login

A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the event is viewed. Updating to version 14.2.1 or later is recommended to remediate this vulnerability.

Affected products Warnungen 0 Metrics 2 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Vanderbilt ≫ Redcap Version < 14.2.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.32%	0.546

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.evms.edu/research/resources_services/redcap/redcap_change_log/

Release Notes

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396/

Third Party Advisory

Exploit

https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2024-37396

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-37396

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-37396

EUVD