Medium severity · published Nov 2, 2020
CVE-2020-27358
An issue was discovered in REDCap 8.11.6 through 9.x before 10
4.3
CVSS
2%
EPSS
No
On KEV
Description
An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redcap · Vanderbilt
8.11.6 before 10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27358
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27358
Exploit
https://github.com/seb1055/cve-2020-27358-27359
Exploit
https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
Third Party Advisory
https://www.ruse.tech/blog/38
More from Redcap
9.8
CVE-2020-26712
REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter
9.0
CVE-2021-42136
A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the…
8.8
CVE-2025-23113
An issue was discovered in REDCap 14.9.6
8.8
CVE-2024-56310
REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery (CSRF) attack
8.8
CVE-2024-56311
REDCap through 14.9.6 has a security flaw in the Notes section of calendar events, exposing users to a Cross-Site Request Forgery (CSRF) attack