CVE-2023-31139 DHIS2 Core unrestricted session cookies with Personal Access Tokens
Attackers can bypass IP or HTTP method restrictions using Personal Access Tokens that generate unrestricted session cookies in DHIS2 Core.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-31139?
CVE-2023-31139 is a medium-severity vulnerability in dhis2-core, published on 9 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
Weakness: CWE-613
Which versions are affected by CVE-2023-31139?
It affects 1 product.
Products include Dhis2 Dhis 2.
How do I fix CVE-2023-31139?
No fix has been published for CVE-2023-31139 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-31139 being exploited?
There is no known exploitation of CVE-2023-31139 in the wild and no public exploit code.
Other vulnerabilities in dhis2-core
- CVE-2022-24848 SQL Injection in DHIS2's in OrgUnit program association
- CVE-2021-39179 SQL Injection in DHIS2 Tracker API
- CVE-2021-32704 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
- CVE-2021-41187 SQL Injection in DHIS2 Tracker API
- CVE-2023-31138 DHIS2 Core vulnerable to Improper Access Control with PATCH requests
Sources
Also known as GHSA-44g3-9mp4-prv3.