VULNERABILITY INTELLIGENCE

CVE-2024-56311

CVSS score8.8 HIGH
EPSS probability0.31%
CISA KEVNot currently listed
Published2024-12-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into accessing a calendar event's notes, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.

Weakness classification

  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references