Security readout for executives and security teams
Plain-English summary
This CVE is a stored XSS issue in Vanderbilt REDCap's new project creation flow. A crafted project title can store script or HTML that later runs in another user's browser. The bundle does not provide CVSS, patch status, or broad affected-version data.
Executive priority
Prioritize REDCap environments handling sensitive research or health data. This is not KEV-listed in the bundle, but stored XSS can affect user trust and data confidentiality.
Technical view
CVE-2023-37798 describes insufficient output handling for the project title parameter during REDCap project creation in version 13.1.35, allowing stored web script or HTML execution. The provided metadata lists affected product fields as n/a, so version scope beyond the description is not confirmed.
Likely exposure
Organizations running Vanderbilt REDCap 13.1.35, especially where users can create new projects or influence project titles, should treat this as potentially relevant.
Exploitation context
The bundle does not show KEV listing or active exploitation evidence. Exploitation centers on storing malicious content in a project title, but authentication requirements and required privileges are not stated.
Researcher notes
Evidence is limited to the CVE description and one public reference. No CVSS vector, CWE, vendor advisory, fixed release, privilege requirement, or exploit-in-the-wild evidence is included.
Mitigation direction
- Check Vanderbilt REDCap guidance for fixed versions or vendor-supported remediation.
- Restrict project creation permissions to trusted users until remediation is confirmed.
- Review project titles for unexpected markup or script-like content.
- Apply defense-in-depth controls for session protection and content security where supported.
Validation and detection
- Inventory REDCap deployments and identify version 13.1.35 instances.
- Confirm who can create projects or modify project titles.
- Review application logs for suspicious project title submissions.
- Use safe, non-executing test cases to verify output encoding in project titles.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-37798 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cyderes.com/blog/cve-2023-37798-stored-cross-site-scripting-in-vanderbilt-redcap/CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.