CVE-2023-37361

Severity Score

2.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.

*Credits: N/A

CVSS Scores

NISTv3.1 2.7

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-06-30 CVE Reserved
2023-07-25 CVE Published
2024-07-31 EPSS Updated
2024-10-23 CVE Updated
2024-10-23 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (2)

URL	Tag	Source
https://trustwave.com	Not Applicable

URL	Date	SRC
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=32305	2024-10-23

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vanderbilt Search vendor "Vanderbilt"		Redcap Search vendor "Vanderbilt" for product "Redcap"				< 12.3.2 Search vendor "Vanderbilt" for product "Redcap" and version " < 12.3.2"		-		Affected
Vanderbilt Search vendor "Vanderbilt"		Redcap Search vendor "Vanderbilt" for product "Redcap"				< 12.0.26 Search vendor "Vanderbilt" for product "Redcap" and version " < 12.0.26"		lts		Affected