REDCap Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in REDCap version 14.9.6. The issue arises in the email-subject field when a CSV file containing a list of alert configurations is uploaded. An attacker can craft a CSV file with an XSS payload embedded in the email-subject. When the victim uploads this file, they are directed to a page displaying the uploaded data. Clicking on the email-subject value activates the XSS payload.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.