CVE-2024-37395 Cross-site scripting in n/a
Authenticated users can inject malicious scripts into survey fields, leading to arbitrary code execution when victims access the public survey link.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-37395?
CVE-2024-37395 is a medium-severity cross-site scripting vulnerability in n/a, published on 10 Jun 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by attackers to execute malicious scripts when the survey is accessed through its public link. It is advised to update to version 14.2.1 or later to fix this issue.
Weakness: CWE-79
Which versions are affected by CVE-2024-37395?
It affects 1 product.
Products include Vanderbilt Redcap.
How do I fix CVE-2024-37395?
No fix has been published for CVE-2024-37395 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-37395 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37395 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2972-gp35-c62r.