High severity · published May 9, 2023
CVE-2023-31139
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
D2
Dhis 2 · Dhis2
2.37.0 before 2.37.9.1; 2.38.0 before 2.38.3.1; 2.39.0 before 2.39.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-31139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-31139
Third Party Advisory
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-44g3-9mp4-prv3
Release Notes
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md
Release Notes
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md
Release Notes
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.39.1.2.md
More from Dhis 2
8.8
CVE-2022-24848
DHIS2 is an information system for data capture, management, validation, analytics and visualization
8.8
CVE-2021-41187
DHIS 2 is an information system for data capture, management, validation, analytics and visualization
8.8
CVE-2021-39179
DHIS 2 is an information system for data capture, management, validation, analytics and visualization
8.8
CVE-2021-32704
DHIS 2 is an information system for data capture, management, validation, analytics and visualization
7.2
CVE-2022-41948
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization