REDCap through 15.0.0 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.
Metrics
Affected Vendors & Products
References
History
Tue, 24 Dec 2024 03:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-352 | |
Metrics |
cvssV3_1
|
Sun, 22 Dec 2024 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | REDCap through 15.0.0 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent. | |
References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2024-12-22T00:00:00
Updated: 2024-12-24T02:23:01.331Z
Reserved: 2024-12-18T00:00:00
Link: CVE-2024-56311
Vulnrichment
Updated: 2024-12-24T02:22:53.318Z
NVD
Status : Awaiting Analysis
Published: 2024-12-22T21:15:16.600
Modified: 2024-12-24T03:15:07.607
Link: CVE-2024-56311
Redhat
No data.