CVE-2023-32060

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-32060
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32060.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-32060
Aliases
  • GHSA-7pwm-6rh2-2388
Published
2023-05-09T14:54:39.707Z
Modified
2025-12-20T02:52:21.932127Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
Details

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker program events or program stages, the /trackedEntityInstances and /events API endpoints may include all events regardless of the sharing settings applied to the category option combinations. When this specific configuration is present, users may have access to events which they should not be able to see based on the sharing settings of the category options. The events will not appear in the user interface for web-based Tracker Capture or Capture applications, but if the Android Capture App is used they will be displayed to the user. Versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0 contain a fix for this issue. No workaround is known.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32060.json"
}
References

Affected packages

Git / github.com/dhis2/dhis2-core

Affected ranges

Type
GIT
Repo
https://github.com/dhis2/dhis2-core
Events
Introduced
4219a14c2b2ad021231a00b1c9607e5ab6e514fd
Fixed
a1d81066250852107353e3c524e281e686d83c18
Database specific 
{
    "versions": [
        {
            "introduced": "2.35"
        },
        {
            "fixed": "2.36.13"
        }
    ]
}
Type
GIT
Repo
https://github.com/dhis2/dhis2-core
Events
Introduced
b8d4ef368ffa769034b36e143551be28a671c12c
Fixed
d9a77b2b2190e972789d6a66c85b89845428e9f6
Database specific 
{
    "versions": [
        {
            "introduced": "2.37"
        },
        {
            "fixed": "2.37.8"
        }
    ]
}
Type
GIT
Repo
https://github.com/dhis2/dhis2-core
Events
Introduced
769bded6742261c68549654e8beacdcff2674c2a
Fixed
3f41220158828f8c74f9b0c5d9d9bdc47d53d004
Database specific 
{
    "versions": [
        {
            "introduced": "2.38"
        },
        {
            "fixed": "2.38.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32060.json"