CVE-2023-31139: DHIS2 Core unrestricted session cookies with Personal Access Tokens
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31139?
CVE-2023-31139 has a severity rating that indicates potential for exploitation through unrestricted session cookies.
How do I fix CVE-2023-31139?
To fix CVE-2023-31139, upgrade to DHIS2 Core versions 2.37.9.1, 2.38.3.1, or 2.39.1.2.
What versions of DHIS2 are affected by CVE-2023-31139?
CVE-2023-31139 affects DHIS2 Core versions before 2.37.9.1, 2.38.3.1, and 2.39.1.2.
What vulnerability does CVE-2023-31139 introduce?
CVE-2023-31139 introduces a vulnerability that allows a bypass of security mechanisms through unrestricted session cookies.
Is CVE-2023-31139 related to Personal Access Tokens?
Yes, CVE-2023-31139 is related to Personal Access Tokens that generate unrestricted session cookies in DHIS2.