CVE-2023-37361
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
REDCap versions 12.0.26 LTS and 12.3.2 Standard allow SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the exposure of sensitive information.
Recommendation
It is recommended to upgrade to the latest version of REDCap to mitigate the risk associated with this vulnerability.
Other vulnerabilities in REDCap
See all- CVE-2026-90817Critical
An unauthenticated Remote Code Execution vulnerability was found in REDCap 13.3.0 and higher in the survey passthrough routing and Data Import processing logic. An attacker can manipulate HTTP requests to access an unintended controller route from a public survey context and supply a crafted file-path/stream parameter during import handling. Exploitation requires knowledge of a valid public survey hash.
- CVE-2024-55374Medium
A vulnerability in REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy in login attempt responses.
- CVE-2023-37798Medium
A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.
Original NVD description (English source)
REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS