« Volver al listado

CVE-2022-41949

Estado: ModificadaMedia (4.3)—

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources (like third party servers). This could allow an attacker, for example, to identify vulnerable services which might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. At this time, there is no known workaround or mitigation for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dhis2 — Dhis 2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-41949",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-41949",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:52:48.163388Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "dhis2",
          "product": "dhis2-core",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.36.12.1"
            },
            {
              "status": "affected",
              "version": ">= 2.37.0.0, < 2.37.8.1"
            },
            {
              "status": "affected",
              "version": ">= 2.38.0.0, < 2.38.2.1"
            },
            {
              "status": "affected",
              "version": ">= 2.39.0.0, < 2.39.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-08T22:15:10.483",
  "references": [
    {
      "url": "https://github.com/dhis2/dhis2-core/commit/dc3166c216da53e12a16bfdc51055823b838c1c3",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6qh9-rxc8-7943",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/commit/dc3166c216da53e12a16bfdc51055823b838c1c3",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6qh9-rxc8-7943",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources (like third party servers). This could allow an attacker, for example, to identify vulnerable services which might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. At this time, there is no known workaround or mitigation for this vulnerability."
    },
    {
      "lang": "es",
      "value": "DHIS 2 es un sistema de información de código abierto para captura, gestión, validación, análisis y visualización de datos. En las versiones afectadas, un usuario de DHIS2 autenticado puede elaborar una solicitud a DHIS2 para indicarle al servidor que realice solicitudes a recursos externos (como servidores de terceros). Esto podría permitir a un atacante, por ejemplo, identificar servicios vulnerables que de otro modo no estarían expuestos a la internet pública o determinar si un archivo específico está presente en el servidor DHIS2. Los administradores de DHIS2 deben actualizar a las siguientes versiones de revisión: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. En este momento, no se conoce ningún workaround o mitigación para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T05:04:07.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A9F2DA7-1719-4054-9C5F-FDD673050BD5",
              "versionEndExcluding": "2.36.12.1",
              "versionStartIncluding": "2.34.0"
            },
            {
              "criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6BDDC0C-4FFE-474A-827E-978DD52338C7",
              "versionEndExcluding": "2.37.8.1",
              "versionStartIncluding": "2.37.0"
            },
            {
              "criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5767431-7751-48F4-8F6F-2D4A6CADABBB",
              "versionEndExcluding": "2.38.2.1",
              "versionStartIncluding": "2.38.0"
            },
            {
              "criteria": "cpe:2.3:a:dhis2:dhis_2:2.39.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2EB62DB-53E9-47D3-8659-392DE9A8351A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}