CVE-2022-41949

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources (like third party servers). This could allow an attacker, for example, to identify vulnerable services which might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. At this time, there is no known workaround or mitigation for this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Dec 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-41954.3Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing w CVE-2022-419507.8super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. Th CVE-2022-419519.8OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business applications easier and faster. Pat CVE-2022-419525.3Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly li CVE-2022-419537.8Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on CVE-2022-419543.3MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems CVE-2022-419558.8Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to CVE-2022-419566.5Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to CVE-2022-419577.5Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and fr CVE-2022-419587.8super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yam CVE-2022-41964.8The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege use CVE-2022-419604.3BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authentic