CVE-2024-55374 identifies an information disclosure vulnerability in REDCap 14.3.13 where an attacker can enumerate usernames due to observable discrepancies in the system's response to login attempts. This behavior allows an unauthenticated attacker to confirm the existence of usernames, potentially aiding further targeted attacks. The vulnerability does not impact confidentiality beyond username disclosure, nor does it affect integrity or availability. No official patch or remediation guidance is currently available, and the affected version is specifically REDCap 14.3.13.

The vulnerability enables an attacker to enumerate valid usernames on the REDCap 14.3.13 system by analyzing differences in login attempt responses. This information disclosure could facilitate further attacks such as targeted phishing or brute force attempts. There is no direct impact on data integrity or system availability. Confidentiality impact is limited to username information only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing generic mitigations such as uniform error messages on login failures to prevent username enumeration. Monitor for vendor updates regarding patches or official mitigations.