REDCap through 15.0.0 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and terminates their session. This vulnerability stems from the absence of CSRF protections on the logout functionality, allowing malicious actions to be executed without user consent.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-56310
• https://github.com/ping-oui-no/Vulnerability-Research-CVESS/tree/main/RedCap
• https://www.evms.edu/research/resources_services/redcap/redcap_change_log