Medium severity · published May 9, 2023
CVE-2023-31138
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an object may be able to modify related objects that they should not have access to. DHIS2 implementers should upgrade to a supported version of DHIS2 to receive a patch: 2.37.9.1, 2.38.3.1, or 2.39.1.2. It is possible to work around this issue by blocking all PATCH requests on a reverse proxy, but this may cause some issues with the functionality of built-in applications using legacy PATCH requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DH
dhis2-core · dhis2
>= 2.36, < 2.37.9.1; >= 2.38, < 2.38.3.1; >= 2.39, < 2.39.1.2 · source: vendor
D2
Dhis 2 · Dhis2
2.36.0 before 2.37.9.1; 2.38.0 before 2.38.3.1; 2.39.0 before 2.39.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-31138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-31138
Third Party Advisory
https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwvw-4m67-f4g2
Release Notes
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.37/ReleaseNote-2.37.9.1.md
Release Notes
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.38/ReleaseNote-2.38.3.1.md
Release Notes
https://github.com/dhis2/dhis2-releases/blob/master/releases/2.39/ReleaseNote-2.39.1.2.md
More from dhis2-core
9.1
CVE-2026-55083
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
8.8
CVE-2026-55084
SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
8.7
CVE-2026-55082
DHIS2 SQL injection in SQL View filter values
7.5
CVE-2023-31139
DHIS2 Core unrestricted session cookies with Personal Access Tokens
7.3
CVE-2026-55081
DHIS2 Reflected XSS in OpenAPI HTML scope parameter