REDCap through 15.0.0 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.
History

Sun, 22 Dec 2024 21:15:00 +0000

Type Values Removed Values Added
Description REDCap through 15.0.0 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-12-22T00:00:00

Updated: 2024-12-22T21:07:15.573497

Reserved: 2024-12-18T00:00:00

Link: CVE-2024-56311

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2024-12-22T21:15:16.600

Modified: 2024-12-22T21:15:16.600

Link: CVE-2024-56311

cve-icon Redhat

No data.