CVE-2024-55374
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy in login attempt responses.
Risk Assessment
An attacker can compile a list of valid usernames, facilitating brute-force or social engineering attacks against the system.
Recommendation
Update REDCap to the latest version and implement uniform login error messages to prevent distinguishing between existing and non-existing users.
Other vulnerabilities in REDCap
See all- CVE-2023-37798Medium
A stored XSS vulnerability was discovered in REDCap 13.1.35 in the new project creation function. Attackers can inject malicious JavaScript or HTML into the project title parameter, leading to script execution in other users' browsers.
- CVE-2023-37361Low
REDCap versions 12.0.26 LTS and 12.3.2 Standard allow SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
Original NVD description (English source)
REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.