Vulnerability Description
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dhis2 | Dhis 2 | >= 2.37.0, < 2.37.9.1 |
Related Weaknesses (CWE)
References
- https://github.com/dhis2/dhis2-core/security/advisories/GHSA-44g3-9mp4-prv3Third Party Advisory
- https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.Release Notes
- https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.Release Notes
- https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.Release Notes
- https://github.com/dhis2/dhis2-core/security/advisories/GHSA-44g3-9mp4-prv3Third Party Advisory
- https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.Release Notes
- https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.Release Notes
- https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.Release Notes
FAQ
What is CVE-2023-31139?
CVE-2023-31139 is a vulnerability with a CVSS score of 4.3 (MEDIUM). DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access...
How severe is CVE-2023-31139?
CVE-2023-31139 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-31139?
Check the references section above for vendor advisories and patch information. Affected products include: Dhis2 Dhis 2.