Lucene search

MitreCVE-2013-4609

HistoryJun 17, 2013 - 11:38 a.m.

CVE-2013-4609

2013-06-1711:38:53

CWE-264

mitre

web.nvd.nist.gov

redcap

access restrictions

bypass

security vulnerability

cve-2013-4609

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.002

Percentile

56.4%

JSON

REDCap before 5.0.4 and 5.1.x before 5.1.3 does not reject certain undocumented syntax within branching logic and calculations, which allows remote authenticated users to bypass intended access restrictions via (1) the Online Designer or (2) the Data Dictionary upload, as demonstrated by an eval call.

Affected configurations

Nvd

Node

project-redcapredcapMatch4.13.18

project-redcapredcapMatch4.14.5

project-redcapredcapMatch4.14.6

project-redcapredcapMatch4.15.0

project-redcapredcapMatch4.15.1

project-redcapredcapMatch4.15.2

project-redcapredcapMatch4.15.3

project-redcapredcapMatch4.15.4

project-redcapredcapMatch5.0.0

project-redcapredcapMatch5.0.1

project-redcapredcapMatch5.0.2

project-redcapredcapMatch5.1.0

project-redcapredcapMatch5.1.1

project-redcapredcapMatch5.1.2

vanderbiltredcapRange≤5.0.3

vanderbiltredcapMatch4.14.0

vanderbiltredcapMatch4.14.1

vanderbiltredcapMatch4.14.2

vanderbiltredcapMatch4.14.3

vanderbiltredcapMatch4.14.4

VendorProductVersionCPE
project-redcapredcap4.13.18cpe:2.3:a:project-redcap:redcap:4.13.18:*:*:*:*:*:*:*
project-redcapredcap4.14.5cpe:2.3:a:project-redcap:redcap:4.14.5:*:*:*:*:*:*:*
project-redcapredcap4.14.6cpe:2.3:a:project-redcap:redcap:4.14.6:*:*:*:*:*:*:*
project-redcapredcap4.15.0cpe:2.3:a:project-redcap:redcap:4.15.0:*:*:*:*:*:*:*
project-redcapredcap4.15.1cpe:2.3:a:project-redcap:redcap:4.15.1:*:*:*:*:*:*:*
project-redcapredcap4.15.2cpe:2.3:a:project-redcap:redcap:4.15.2:*:*:*:*:*:*:*
project-redcapredcap4.15.3cpe:2.3:a:project-redcap:redcap:4.15.3:*:*:*:*:*:*:*
project-redcapredcap4.15.4cpe:2.3:a:project-redcap:redcap:4.15.4:*:*:*:*:*:*:*
project-redcapredcap5.0.0cpe:2.3:a:project-redcap:redcap:5.0.0:*:*:*:*:*:*:*
project-redcapredcap5.0.1cpe:2.3:a:project-redcap:redcap:5.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
project-redcap	redcap	4.13.18	cpe:2.3:a:project-redcap:redcap:4.13.18:::::::*
project-redcap	redcap	4.14.5	cpe:2.3:a:project-redcap:redcap:4.14.5:::::::*
project-redcap	redcap	4.14.6	cpe:2.3:a:project-redcap:redcap:4.14.6:::::::*
project-redcap	redcap	4.15.0	cpe:2.3:a:project-redcap:redcap:4.15.0:::::::*
project-redcap	redcap	4.15.1	cpe:2.3:a:project-redcap:redcap:4.15.1:::::::*
project-redcap	redcap	4.15.2	cpe:2.3:a:project-redcap:redcap:4.15.2:::::::*
project-redcap	redcap	4.15.3	cpe:2.3:a:project-redcap:redcap:4.15.3:::::::*
project-redcap	redcap	4.15.4	cpe:2.3:a:project-redcap:redcap:4.15.4:::::::*
project-redcap	redcap	5.0.0	cpe:2.3:a:project-redcap:redcap:5.0.0:::::::*
project-redcap	redcap	5.0.1	cpe:2.3:a:project-redcap:redcap:5.0.1:::::::*

Rows per page:

1-10 of 201

References

ctsi.psu.edu/wp-content/uploads/2013/03/REDCap-Release-Notes-Version5.pdf

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.002

Percentile

56.4%

JSON

Related for CVE-2013-4609