CVE-2023-31139

CVSS V2 None CVSS V3 None
Description
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
Overview
  • CVE ID
  • CVE-2023-31139
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Received
  • Published Version
  • 2023-05-09T15:15:10
  • Last Modified Date
  • 2023-05-09T15:15:10
Weakness Enumerations
CWE URL
CWE-613 http://cwe.mitre.org/data/definitions/613.html
References
Reference URL Reference Tags
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-44g3-9mp4-prv3
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.39.1.2.md
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-31139
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31139
History
Created Old Value New Value Data Type Notes
2023-05-09 16:00:33 Added to TrackCVE
2023-05-09 16:00:36 Weakness Enumeration new