CVE-2022-24004

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11

published June 15, 2022

CVSS
—
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title (aka new_title) field when editing an existing conversation. The payload executes in the browser of any conversation participant with the sidebar shown.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00719 · 53.4th percentile
Published
2022-06-15T18:16Z
EPSS history
Timeline
  • 15 JUN 18:16Z
    A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11
    cvelistv5