CVE-2020-26713 - CVE House
Back to Database
Status published Medium CVE-2020-26713

REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function...

Vulnerability Description

REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26713

Credits & Attribution

No credits recorded in the NVD database.

References

More from vanderbilt

View All →
CVE-2022-42715
A reflected XSS vulnerability exists in REDCap before 12.04.18 in...
Unknown 0
CVE-2022-24127
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ProjectGeneral/edit_project_settings.php...
Medium 5.4
CVE-2022-24004
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php...
Medium 5.4
CVE-2021-42136
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data...
Critical 9
CVE-2020-27358
An issue was discovered in REDCap 8.11.6 through 9.x before...
Medium 4.3

Affected Vendor

Affected Software

redcap
Vulnerable Versions:
10.0.20, 10.3.4

Timeline

Official Publish: January 12th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.