Dhis 2
CVE-2022-41947
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated user to open the malicious file in a browser which would trigger the javascript code, resulting in a cross-site scripting (XSS) attack. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. Users unable to upgrade may add the following simple CSP rule in your web proxy to the vulnerable endpoints: script-src 'none'. This workaround will prevent all javascript from running on those endpoints.
AnalysisAI
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated user to open the malicious file in a browser which would trigger the javascript code, resulting in a cross-site scripting (XSS) attack. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. Users unable to upgrade may add the following simple CSP rule in your web proxy to the vulnerable endpoints: script-src 'none'. This workaround will prevent all javascript from running on those endpoints. Affected products include: Dhis2 Dhis 2.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. Rated high severi
DHIS2 is an information system for data capture, management, validation, analytics and visualization. Rated high severit
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. Rated high severi
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. Rated high severi
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Rated high severity
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Rated
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Rated medium severi
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Rated medium severi
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Rated
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today