What is CVE-2024-56377?

CVE-2024-56377 is a medium-severity vulnerability in Vanderbilt Redcap, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-01-09.

How severe is CVE-2024-56377?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Vanderbilt Redcap

CVE-2024-56377

A stored cross-site scripting (XSS) vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload (which has been injected into all survey fields) is executed, potentially enabling the execution of arbitrary web scripts.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (31.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Vanderbilt Redcap — versions 14.9.6

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Release Notes)
cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-56377?: CVE-2024-56377 is a medium-severity vulnerability in Vanderbilt Redcap, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-01-09.
How severe is CVE-2024-56377?: Medium severity. CVSS v3 base score is 5.4 out of 10.