CVE-2023-37798
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.
Risk Assessment
The risk includes session hijacking, user account takeover, or theft of sensitive research data stored in REDCap. The attack could be used to spread malware within the organization.
Recommendation
Immediately update REDCap to the latest version containing the XSS fix. Additionally, implement input filtering and output encoding for the project title parameter.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter.