CVE-2023-32060: DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker program events or program stages, the /trackedEntityInstances and /events API endpoints may include all events regardless of the sharing settings applied to the category option combinations. When this specific configuration is present, users may have access to events which they should not be able to see based on the sharing settings of the category options. The events will not appear in the user interface for web-based Tracker Capture or Capture applications, but if the Android Capture App is used they will be displayed to the user. Versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0 contain a fix for this issue. No workaround is known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-32060?
CVE-2023-32060 has been assigned a high severity rating due to its potential impact on data access controls.
How do I fix CVE-2023-32060?
To fix CVE-2023-32060, update your DHIS2 software to versions 2.36.13, 2.37.8, 2.38.2, or 2.39.0.
What systems are affected by CVE-2023-32060?
CVE-2023-32060 affects DHIS2 Core versions from 2.35.0 to just before 2.36.13 and similar ranges for subsequent versions.
What vulnerabilities does CVE-2023-32060 address?
CVE-2023-32060 addresses critical issues related to improper configuration of Category Option Combination Sharing settings.
When was CVE-2023-32060 disclosed?
CVE-2023-32060 was disclosed in 2023, highlighting vulnerabilities in specific versions of DHIS2 Core.