PT-2022-26178 · Dhis2 · Dhis2

Philip-Larsen-Donnelly · Published 2022-12-08 · Updated 2022-12-12 · CVE-2022-41949

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DHIS2 versions prior to 2.36.12.1 DHIS2 versions prior to 2.37.8.1 DHIS2 versions prior to 2.38.2.1 DHIS2 versions prior to 2.39.0.1

Description DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions, an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources, such as third-party servers. This could allow an attacker to identify vulnerable services that might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server.

Recommendations For versions prior to 2.36.12.1, upgrade to version 2.36.12.1. For versions prior to 2.37.8.1, upgrade to version 2.37.8.1. For versions prior to 2.38.2.1, upgrade to version 2.38.2.1. For versions prior to 2.39.0.1, upgrade to version 2.39.0.1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-41949

GHSA-6QH9-RXC8-7943

Affected Products

Dhis2

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41949.json · Exploit
• https://github.com/dhis2/dhis2-core/commit/dc3166c216da53e12a16bfdc51055823b838c1c3 · Patch
• https://osv.dev/vulnerability/CVE-2022-41949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41949 · Security Note
• https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6qh9-rxc8-7943 · Note
• https://t.me/cibsecurity/54199 · Telegram Post
• https://t.me/cvenotify/39485 · Telegram Post