PT-2023-23171 · Unknown · Dhis2 Core

Michael-Markevich

·

Publicado

2023-05-09

·

Atualizado

2023-05-16

·

CVE-2023-31138

CVSS v3.1

7.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Name of the Vulnerable Software and Affected Versions DHIS2 Core versions 2.36 through 2.37.9.1 DHIS2 Core versions 2.36 through 2.38.3.1 DHIS2 Core versions 2.36 through 2.39.1.2
Description DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Using object model traversal in the payload of a PATCH request, authenticated users with write access to an object may be able to modify related objects that they should not have access to.
Recommendations For DHIS2 Core versions 2.36 through 2.37.9.1, upgrade to version 2.37.9.1 to receive a patch. For DHIS2 Core versions 2.36 through 2.38.3.1, upgrade to version 2.38.3.1 to receive a patch. For DHIS2 Core versions 2.36 through 2.39.1.2, upgrade to version 2.39.1.2 to receive a patch. As a temporary workaround, consider blocking all PATCH requests on a reverse proxy, but this may cause some issues with the functionality of built-in applications using legacy PATCH requests.

Exploit

Correção

Incorrect Authorization

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863CWE-284

Identificadores relacionados

CVE-2023-31138
GHSA-PWVW-4M67-F4G2

Produtos afetados

Dhis2 Core