CVE-2020-27358

MEDIUM

REDCap 8.11.6-9.x - Unauthenticated Information Disclosure via Messenger CSV Export

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-27358. PoCs published by sebastian-mora.

AI-analyzed exploit summary This repository provides a detailed writeup for exploiting CVE-2020-27358 (IDOR in REDCap's messenger CSV export) and CVE-2020-27359 (XSS via filename in messenger attachments). It includes step-by-step testing instructions but no actual exploit code.

Description

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.

Exploits (1)

nomisec WRITEUP 3 stars
by sebastian-mora · poc
https://github.com/sebastian-mora/cve-2020-27358-27359

This repository provides a detailed writeup for exploiting CVE-2020-27358 (IDOR in REDCap's messenger CSV export) and CVE-2020-27359 (XSS via filename in messenger attachments). It includes step-by-step testing instructions but no actual exploit code.

Classification
Writeup 90%
Attack Type
Info Leak | Xss
Complexity
Trivial
Reliability
Reliable
Target: REDCap 8.11.6 through 9.x before 10
Auth required
Prerequisites: valid user credentials · access to REDCap messenger feature
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://www.ruse.tech/blog/38
Exploit, Third Party Advisory x_refsource_misc
https://github.com/seb1055/cve-2020-27358-27359

Scores

CVSS v3 4.3
EPSS 0.0343
EPSS Percentile 87.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-276
Status published
Products (1)
vanderbilt/redcap 8.11.6 - 10.0
Published Nov 02, 2020
Tracked Since Feb 18, 2026