CVE Vulnerability

CVE-2020-26712

REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. The application uses the addition of a string of information from the submitted user that is not validated well in the database query, resulting in an SQL injection vulnerability where an attacker can exploit and compromise all databases.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/vuongdq54/RedCap Exploit Third Party Advisory
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/ Release Notes Vendor Advisory
https://www.project-redcap.org/ Product Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:vanderbilt:redcap:10.3.4:*:*:*:-:*:*:*
cpe:2.3:a:vanderbilt:redcap:10.0.20:*:*:*:lts:*:*:*
Information

Published : 2021-01-12 03:15

Updated : 2021-07-01 04:55

NVD link : CVE-2020-26712

Mitre link : CVE-2020-26712

Products Affected
No products.
CWE
CWE-89