CVE-2023-32060

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker program events or program stages, the `/trackedEntityInstances` and `/events` API endpoints may include all events regardless of the sharing settings applied to the category option combinations. When this specific configuration is present, users may have access to events which they should not be able to see based on the sharing settings of the category options. The events will not appear in the user interface for web-based Tracker Capture or Capture applications, but if the Android Capture App is used they will be displayed to the user. Versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0 contain a fix for this issue. No workaround is known.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388	Third Party Advisory
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dhis2:dhis_2::::::::
	cpe:2.3:a:dhis2:dhis_2::::::::
	cpe:2.3:a:dhis2:dhis_2::::::::

History

21 Nov 2024, 08:02

Type	Values Removed	Values Added
References	~~() https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388 - Third Party Advisory~~	() https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388 - Third Party Advisory

Information

Published : 2023-05-09 15:15

Updated : 2024-11-21 08:02

NVD link : CVE-2023-32060

Mitre link : CVE-2023-32060

CVE.ORG link : CVE-2023-32060

JSON object : View

Products Affected

dhis2

dhis_2

CWE

CWE-284

Improper Access Control

CWE-863

Incorrect Authorization

{"id": "CVE-2023-32060", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-05-09T15:15:10.367", "references": [{"url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-7pwm-6rh2-2388", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker program events or program stages, the `/trackedEntityInstances` and `/events` API endpoints may include all events regardless of the sharing settings applied to the category option combinations. When this specific configuration is present, users may have access to events which they should not be able to see based on the sharing settings of the category options. The events will not appear in the user interface for web-based Tracker Capture or Capture applications, but if the Android Capture App is used they will be displayed to the user. Versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0 contain a fix for this issue. No workaround is known."}], "lastModified": "2024-11-21T08:02:38.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74791199-BB09-41D9-A1F8-AF5496A2599C", "versionEndExcluding": "2.36.13", "versionStartIncluding": "2.35.0"}, {"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94F6CC42-75F0-4E51-9E92-0FE0EC14B08F", "versionEndExcluding": "2.37.8", "versionStartIncluding": "2.37.0"}, {"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "083AAA85-872D-4A80-9420-F0DE48B3E9FD", "versionEndExcluding": "2.38.2", "versionStartIncluding": "2.38.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}