« Volver al listado

CVE-2024-56310

Estado: AnalizadaAlta (8.8)—

REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

UI:R (interacción requerida) + XSS/CSRF payload en nombre de Dashboard → T1203. Impacto: logout forzado = T1185 (Man-in-the-Middle, aquí redirección/sesión hijacked).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingUser Account ManagementApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Vanderbilt — Redcap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-56310",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-56310",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-24T02:24:34.277939Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-22T21:15:16.433",
  "references": [
    {
      "url": "https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.evms.edu/research/resources_services/redcap/redcap_change_log/",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent."
    },
    {
      "lang": "es",
      "value": "REDCap hasta la versión 15.0.0 tiene una falla de seguridad en el nombre de Project Dashboards, lo que expone a los usuarios a un ataque de Cross-Site Request Forgery (CSRF). Un atacante puede aprovechar esto al atraer a los usuarios para que hagan clic en un nombre de Project Dashboards que contenga la carga maliciosa, lo que desencadena una solicitud de cierre de sesión y finaliza su sesión. Esta vulnerabilidad se origina en la ausencia de protecciones CSRF en la funcionalidad de cierre de sesión, lo que permite que se ejecuten acciones maliciosas sin el consentimiento del usuario."
    }
  ],
  "lastModified": "2026-06-17T08:12:00.910",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanderbilt:redcap:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08C656CE-426D-43CB-BB3A-92EDFA9B40B6",
              "versionEndIncluding": "14.9.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}