CVE-2021-42136

moderate-risk
Published 2022-04-13

A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.

Do I need to act?

~
1.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
50877
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.0/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Vanderbilt

References (6)

Exploit http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html
Release Notes https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf
Product https://www.project-redcap.org/
Exploit http://packetstormsecurity.com/files/166723/REDCap-Cross-Site-Scripting.html
Release Notes https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf
Product https://www.project-redcap.org/
40
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 5/34 · Minimal
Exposure 5/34 · Minimal