{"containers": {"cna": {"affected": [{"product": "dhis2-core", "vendor": "dhis2", "versions": [{"status": "affected", "version": "= 2.32"}, {"status": "affected", "version": "= 2.33"}, {"status": "affected", "version": ">= 2.34.0, < 2.34.7"}, {"status": "affected", "version": ">= 2.34.0, < 2.35.7"}, {"status": "affected", "version": ">= 2.36.0, < 2.36.4"}]}], "descriptions": [{"lang": "en", "value": "DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability affects the `/api/trackedEntityInstances` and `/api/trackedEntityInstances/query` API endpoints in all DHIS2 versions 2.34, 2.35, and 2.36. It also affects versions 2.32 and 2.33 which have reached _end of support_ - exceptional security updates have been added to the latest *end of support* builds for these versions. Versions 2.31 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. The vulnerability is not exposed to a non-malicious user - the vulnerability requires a conscious attack to be exploited. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. Security patches are available in DHIS2 versions 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7, and 2.36.4. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the `/api/trackedEntityInstances`, and `/api/trackedEntityInstances/query` endpoints as a temporary workaround while waiting to upgrade."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-29T13:20:10", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/pull/8771"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6"}], "source": {"advisory": "GHSA-cmpc-frjv-rrmw", "discovery": "UNKNOWN"}, "title": "SQL Injection in DHIS2 Tracker API", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-39179", "STATE": "PUBLIC", "TITLE": "SQL Injection in DHIS2 Tracker API"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "dhis2-core", "version": {"version_data": [{"version_value": "= 2.32"}, {"version_value": "= 2.33"}, {"version_value": ">= 2.34.0, < 2.34.7"}, {"version_value": ">= 2.34.0, < 2.35.7"}, {"version_value": ">= 2.36.0, < 2.36.4"}]}}]}, "vendor_name": "dhis2"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability affects the `/api/trackedEntityInstances` and `/api/trackedEntityInstances/query` API endpoints in all DHIS2 versions 2.34, 2.35, and 2.36. It also affects versions 2.32 and 2.33 which have reached _end of support_ - exceptional security updates have been added to the latest *end of support* builds for these versions. Versions 2.31 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. The vulnerability is not exposed to a non-malicious user - the vulnerability requires a conscious attack to be exploited. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. Security patches are available in DHIS2 versions 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7, and 2.36.4. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the `/api/trackedEntityInstances`, and `/api/trackedEntityInstances/query` endpoints as a temporary workaround while waiting to upgrade."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw", "refsource": "CONFIRM", "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw"}, {"name": "https://github.com/dhis2/dhis2-core/pull/8771", "refsource": "MISC", "url": "https://github.com/dhis2/dhis2-core/pull/8771"}, {"name": "https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6", "refsource": "MISC", "url": "https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6"}]}, "source": {"advisory": "GHSA-cmpc-frjv-rrmw", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-39179", "datePublished": "2021-10-29T13:20:10", "dateReserved": "2021-08-16T00:00:00", "dateUpdated": "2021-10-29T13:20:10", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C69E468-A816-400F-8C40-69E776489B03", "versionEndIncluding": "2.32.7", "versionStartIncluding": "2.32.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1742533-D56B-4B5A-AA9F-A0F32FE93B44", "versionEndIncluding": "2.33.9", "versionStartIncluding": "2.33.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "matchCriteriaId": "66768511-C108-4F54-AF71-6DCB7FE05954", "versionEndExcluding": "2.35.7", "versionStartIncluding": "2.35.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4A2BF5E-D50E-4CE5-80C5-0FCF34560D42", "versionEndExcluding": "2.36.4", "versionStartIncluding": "2.36.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability affects the `/api/trackedEntityInstances` and `/api/trackedEntityInstances/query` API endpoints in all DHIS2 versions 2.34, 2.35, and 2.36. It also affects versions 2.32 and 2.33 which have reached _end of support_ - exceptional security updates have been added to the latest *end of support* builds for these versions. Versions 2.31 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. The vulnerability is not exposed to a non-malicious user - the vulnerability requires a conscious attack to be exploited. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. Security patches are available in DHIS2 versions 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7, and 2.36.4. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the `/api/trackedEntityInstances`, and `/api/trackedEntityInstances/query` endpoints as a temporary workaround while waiting to upgrade."}, {"lang": "es", "value": "DHIS 2 es un sistema de informaci\u00f3n para la captura, administraci\u00f3n, comprobaci\u00f3n, an\u00e1lisis y visualizaci\u00f3n de datos. Una vulnerabilidad de inyecci\u00f3n SQL en el componente Tracker del servidor DHIS2 permite a atacantes remotos autenticados ejecutar comandos SQL arbitrarios por medio de vectores no especificados. Esta vulnerabilidad afecta a los endpoints de la API \"/api/trackedEntityInstances\" y \"/api/trackedEntityInstances/query\" en todas las versiones de DHIS2 2.34, 2.35 y 2.36. Tambi\u00e9n afecta a las versiones 2.32 y 2.33 que han alcanzado el _fin de soporte_ - se han a\u00f1adido actualizaciones de seguridad excepcionales a las \u00faltimas compilaciones de *fin de soporte* para estas versiones. Las versiones 2.31 y anteriores no se ven afectadas. El sistema es vulnerable a los ataques s\u00f3lo de los usuarios que han iniciado sesi\u00f3n en DHIS2, y no se presenta forma conocida de explotar la vulnerabilidad sin haber iniciado sesi\u00f3n como usuario de DHIS2. La vulnerabilidad no est\u00e1 expuesta a un usuario no malicioso - la vulnerabilidad requiere un ataque consciente para ser explotada. Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad podr\u00eda permitir al usuario malicioso leer, editar y borrar datos en la instancia de DHIS2. No se presentan explotaciones conocidas de las vulnerabilidades de seguridad abordadas por estas versiones de parches. Los parches de seguridad est\u00e1n disponibles en las versiones de DHIS2 2.32-EOS, 2.33-EOS, 2.34.7, 2.35.7 y 2.36.4. No se presenta una soluci\u00f3n directa conocida para las instancias de DHIS2 que usan la funcionalidad de Tracker, aparte de actualizar el servidor DHIS2 afectado a uno de los parches en los que es corregida esta vulnerabilidad. Para las implementaciones que NO usan la funcionalidad Tracker, puede ser posible bloquear todo el acceso de red a POST a los endpoints \"/api/trackedEntityInstances\", y \"/api/trackedEntityInstances/query\" como una soluci\u00f3n temporal mientras se espera para actualizar"}], "id": "CVE-2021-39179", "lastModified": "2021-11-03T00:55:58.353", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Primary"}]}, "published": "2021-10-29T14:15:07.667", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/dhis2/dhis2-core/commit/16674ac75127b0e83691c6b1c9ce745e67ab58b6"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/dhis2/dhis2-core/pull/8771"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-cmpc-frjv-rrmw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}