CVE-2022-24127

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11

published June 15, 2022

CVSS
—
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11. This issue allows any user with project management permissions to inject arbitrary code into the project title (app_title) field when editing an existing project. The payload is then reflected within the title tag of the page.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00724 · 53.5th percentile
Published
2022-06-15T18:16Z
EPSS history
Timeline
  • 15 JUN 18:16Z
    A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php in REDCap 12.0.11
    cvelistv5