{"id":"CVE-2024-56310","aliases":["EUVD-2024-53100","GHSA-rfmp-w9w5-rmhv"],"status":"published","title":"REDCap through 15.0.0 has a security flaw in the Project Dashboards name, exposing users to a...","description":"REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00254,"percentile":0.17143,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-12-22T00:00:00Z","modified":"2026-06-17T08:12:00Z","products":[{"vendor":"vanderbilt","product":"redcap"}],"references":[{"url":"https://www.evms.edu/research/resources_services/redcap/redcap_change_log/","tags":["Product"]},{"url":"https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56310"},{"url":"https://www.evms.edu/research/resources_services/redcap/redcap_change_log"},{"url":"https://github.com/advisories/GHSA-rfmp-w9w5-rmhv"}],"sources":{"cve":[{"id":"CVE-2024-56310","description":"REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.","status":"published","published":"2024-12-22T00:00:00Z","modified":"2025-03-19T13:51:20.367Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:57.638551Z"}],"euvd":[{"id":"EUVD-2024-53100","description":"REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.","status":"published","published":"2024-12-22T00:00:00Z","modified":"2025-03-19T13:51:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:59.541218Z"}],"ghsa":[{"id":"GHSA-rfmp-w9w5-rmhv","title":"REDCap through 15.0.0 has a security flaw in the Project Dashboards name, exposing users to a...","description":"REDCap through 15.0.0 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.","status":"published","published":"2024-12-22T21:30:45Z","modified":"2024-12-24T03:31:46Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:59:15.851629Z"}],"nvd":[{"id":"CVE-2024-56310","description":"REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.","status":"published","published":"2024-12-22T21:15:16.433Z","modified":"2026-06-17T08:12:00.91Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:40.507978Z"}]}}