TI-2022-20290 Aliases CVE-2022-41949

Semi-blind Server-Side Request Forgery in dhis2-core

LOW 23CWE-918Published 2022-12-08 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources (like third party servers). This could allow an attacker, for example, to identify vulnerable services which might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. At this time, there is no known workaround or mitigation for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00434 37th percentileScored 2026-11-07

Fix Fixed dhis2-core (dhis2): 2.36.12.1, 2.37.8.1, 2.38.2.1 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
dhis2	dhis2-core	before 2.36.12.1; 2.37.0.0 to before 2.37.8.1; 2.38.0.0 to before 2.38.2.1; 2.39.0.0 to before 2.39.0.1	2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1	Patch available	CNA

dhis2-core Vendordhis2 Affected before 2.36.12.1; 2.37.0.0 to before 2.37.8.1; 2.38.0.0 to before 2.38.2.1; 2.39.0.0 to before 2.39.0.1 Fixed in 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:dhis2:dhis_2::::::::	2.34.0 to before 2.36.12.1; 2.37.0 to before 2.37.8.1; 2.38.0 to before 2.38.2.1	Vulnerable	dhis2
cpe:2.3:a:dhis2:dhis_2:2.39.0:::::::*	2.39.0	Vulnerable	dhis2

cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:* Versions 2.34.0 to before 2.36.12.1; 2.37.0 to before 2.37.8.1; 2.38.0 to before 2.38.2.1 Vulnerable ·dhis2
cpe:2.3:a:dhis2:dhis_2:2.39.0:*:*:*:*:*:*:* Versions 2.39.0 Vulnerable ·dhis2

Remediation

Fix · CNA dhis2-core (dhis2) Fixed in 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1

Timeline

2026-10-02 Threatist record created from CVE-2022-41949

References

Patch 1

https://github.com/dhis2/dhis2-core/commit/dc3166c216da53e12a16bfdc51055823b838c1c3

Advisory 1

https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6qh9-rxc8-7943

TI-2022-08660 SQL Injection in DHIS2's in OrgUnit program association CVSS 3.1HIGH 8.8
TI-2021-16565 SQL Injection in DHIS2 Tracker API CVSS 3.1HIGH 8.8
TI-2021-18026 SQL Injection in DHIS2 Tracker API CVSS 3.1HIGH 8.8
TI-2021-12372 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core CVSS 3.1HIGH 8.8
TI-2022-20289 Privilege Chaining with the user admin role in dhis2-core CVSS 3.1HIGH 7.2
TI-2023-14849 DHIS2 Core unrestricted session cookies with Personal Access Tokens CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences