critical9.0Public exploit code
CVE-2021-42136
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- REDCap 11.3.9 - Stored Cross Site Scripting2022-04-19 · webapps · php
Impact
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vanderbilt | Redcap | before 11.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html
- https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf
- https://www.project-redcap.org/
- http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html
- https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf
- https://www.project-redcap.org/