Intrusion PreventionREDCap.Missing.Data.Code.Stored.XSS
Description
This indicates an attack attempt to exploit a Cross-Site Scripting Vulnerability in REDCap.
This vulnerability is due to improper input validation and privilege management. A remote attacker could exploit this vulnerability by tricking a user with any privilege into visiting a malicious webpage and send an crafted request to the target server. Successfully exploiting this vulnerability could result privilege bypass and gain root privilege for the target server.
Affected Products
REDCap version 11.3.4 and prior
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 51489 |
| Created | May 02, 2022 |
| Updated | May 17, 2022 |
| Risk |
|
| CVE ID | CVE-2021-42136 |
| Exploit Prediction Score | 17.57% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux, BSD |
| Affected App | Other |