Philip-Larsen-Donnelly

**Name of the Vulnerable Software and Affected Versions** DHIS 2 versions prior to 2.36.12.1 DHIS 2 versions prior to 2.37.8.1 DHIS 2 versions prior to 2.38.2.1 DHIS 2 versions prior to 2.39.0.1 **Description** DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated user to open the malicious file in a browser which would trigger the javascript code, resulting in a cross-site scripting (XSS) attack. **Recommendations** For versions prior to 2.36.12.1, upgrade to version 2.36.12.1. For versions prior to 2.37.8.1, upgrade to version 2.37.8.1. For versions prior to 2.38.2.1, upgrade to version 2.38.2.1. For versions prior to 2.39.0.1, upgrade to version 2.39.0.1. As a temporary workaround for users unable to upgrade, add the following simple CSP rule in your web proxy to the vulnerable endpoints: `script-src 'none'`. This will prevent all javascript from running on those endpoints.

**Name of the Vulnerable Software and Affected Versions** DHIS 2 versions prior to 2.36.12.1 DHIS 2 versions prior to 2.37.8.1 DHIS 2 versions prior to 2.38.2.1 DHIS 2 versions prior to 2.39.0.1 **Description** DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege escalation vulnerability. A DHIS2 user with authority to manage users can assign superuser privileges to themself by manually crafting an HTTP PUT request. Only users with the DHIS2 user role authorities can exploit this vulnerability. The vulnerability is only exploitable by attackers who can authenticate as users with the user admin authority. As this is usually a small and relatively trusted set of users, exploit vectors will often be limited. **Recommendations** For DHIS 2 versions prior to 2.36.12.1, upgrade to version 2.36.12.1. For DHIS 2 versions prior to 2.37.8.1, upgrade to version 2.37.8.1. For DHIS 2 versions prior to 2.38.2.1, upgrade to version 2.38.2.1. For DHIS 2 versions prior to 2.39.0.1, upgrade to version 2.39.0.1. As a temporary workaround, consider avoiding the assignment of the user management authority to any users until the patch has been applied.

**Name of the Vulnerable Software and Affected Versions** DHIS2 versions prior to 2.36.12.1 DHIS2 versions prior to 2.37.8.1 DHIS2 versions prior to 2.38.2.1 DHIS2 versions prior to 2.39.0.1 **Description** DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions, an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources, such as third-party servers. This could allow an attacker to identify vulnerable services that might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server. **Recommendations** For versions prior to 2.36.12.1, upgrade to version 2.36.12.1. For versions prior to 2.37.8.1, upgrade to version 2.37.8.1. For versions prior to 2.38.2.1, upgrade to version 2.38.2.1. For versions prior to 2.39.0.1, upgrade to version 2.39.0.1.

**Name of the Vulnerable Software and Affected Versions** DHIS2 versions prior to 2.36.10.1 and 2.37.6.1 **Description** DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security issue affects the "/api/programs/orgUnits?programs=" API endpoint. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the issue without first being logged in as a DHIS2 user. The issue is not exposed to a non-malicious user and requires a conscious attack to be exploited. A successful exploit could allow the malicious user to read, edit and delete data in the DHIS2 instance's database. **Recommendations** For DHIS2 versions prior to 2.36.10.1, update to version 2.36.10.1 to resolve the issue. For DHIS2 versions prior to 2.37.6.1, update to version 2.37.6.1 to resolve the issue. As a temporary workaround, consider applying mitigations at the web proxy level.

**Name of the Vulnerable Software and Affected Versions** DHIS2 versions 2.32 through 2.36 **Description** DHIS2 is an information system for data capture, management, validation, analytics, and visualization. A SQL injection security issue has been found in specific versions of DHIS2, affecting the API endpoints for "/api/trackedEntityInstances" and "/api/events". The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the issue without first being logged in as a DHIS2 user. A successful exploit could allow the malicious user to read, edit, and delete data in the DHIS2 instance. There are no known exploits of the security issues addressed by these patch releases. **Recommendations** For versions 2.32 through 2.36, install the patches as soon as possible to fix the issue. As a temporary workaround for implementations that do not use Tracker functionality, consider blocking all network access to POST requests to the "/api/trackedEntityInstance" and "/api/events" endpoints while waiting to upgrade. For implementations using Tracker functionality, there is no straightforward known workaround other than upgrading the affected DHIS2 server to one of the patches in which this issue has been fixed.

**Name of the Vulnerable Software and Affected Versions** DHIS2 versions 2.32 through 2.36 **Description** A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors, affecting the "/api/trackedEntityInstances" and "/api/trackedEntityInstances/query" API endpoints. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. **Recommendations** For versions 2.32 and 2.33, upgrade to the latest end of support builds, 2.32-EOS and 2.33-EOS, respectively. For versions 2.34, 2.35, and 2.36, upgrade to versions 2.34.7, 2.35.7, and 2.36.4, respectively. As a temporary workaround for implementations that do not use Tracker functionality, consider blocking all network access to POST requests to the "/api/trackedEntityInstances" and "/api/trackedEntityInstances/query" endpoints.