PT-2022-26176 · Dhis2 · Dhis2

Philip-Larsen-Donnelly · Published 2022-12-08 · Updated 2022-12-12 · CVE-2022-41947

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DHIS 2 versions prior to 2.36.12.1 DHIS 2 versions prior to 2.37.8.1 DHIS 2 versions prior to 2.38.2.1 DHIS 2 versions prior to 2.39.0.1

Description DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated user to open the malicious file in a browser which would trigger the javascript code, resulting in a cross-site scripting (XSS) attack.

Recommendations For versions prior to 2.36.12.1, upgrade to version 2.36.12.1. For versions prior to 2.37.8.1, upgrade to version 2.37.8.1. For versions prior to 2.38.2.1, upgrade to version 2.38.2.1. For versions prior to 2.39.0.1, upgrade to version 2.39.0.1. As a temporary workaround for users unable to upgrade, add the following simple CSP rule in your web proxy to the vulnerable endpoints: script-src 'none'. This will prevent all javascript from running on those endpoints.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41947

GHSA-763W-RM78-6XCG

Affected Products

Dhis2

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41947.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-41947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41947 · Security Note
• https://github.com/dhis2/dhis2-core/security/advisories/GHSA-763w-rm78-6xcg · Note
• https://t.me/cibsecurity/54210 · Telegram Post
• https://t.me/cvenotify/39560 · Telegram Post
• https://t.me/cvenotify/39509 · Telegram Post
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP · Note