CVE-2024-56310

Description

REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.

Weakness classification

• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-352

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Product