CVE-2022-24127

Name of the Vulnerable Software and Affected Versions REDCap version 12.0.11

Description A Stored Cross-Site Scripting issue was discovered in the edit project settings.php file. This issue allows users with project management permissions to inject arbitrary code into the app title field when editing a project. The injected code is then reflected within the title tag of the page.

Recommendations For REDCap version 12.0.11, consider restricting access to the edit project settings.php file until a fix is available, and avoid using the app title field for user-inputted data to minimize the risk of exploitation.