Overview
- Description
- DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated user to open the malicious file in a browser which would trigger the javascript code, resulting in a cross-site scripting (XSS) attack. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. Users unable to upgrade may add the following simple CSP rule in your web proxy to the vulnerable endpoints: `script-src 'none'`. This workaround will prevent all javascript from running on those endpoints.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.4
- Impact score
- 2.7
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
Weaknesses
- security-advisories@github.com
- CWE-79
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1C27E48-5EE7-4A34-916F-8B701C6BF8E0",
"versionEndExcluding": "2.36.12.1",
"versionStartIncluding": "2.35.0"
},
{
"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6BDDC0C-4FFE-474A-827E-978DD52338C7",
"versionEndExcluding": "2.37.8.1",
"versionStartIncluding": "2.37.0"
},
{
"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5767431-7751-48F4-8F6F-2D4A6CADABBB",
"versionEndExcluding": "2.38.2.1",
"versionStartIncluding": "2.38.0"
},
{
"criteria": "cpe:2.3:a:dhis2:dhis_2:2.39.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2EB62DB-53E9-47D3-8659-392DE9A8351A"
}
],
"operator": "OR"
}
]
}
]