CVE-2023-32060 : What You Need to Know

This article provides detailed information about CVE-2023-32060, a vulnerability in DHIS2 Core related to Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events.

Understanding CVE-2023-32060

DHIS2 Core contains a vulnerability in versions prior to 2.36.13, 2.37.8, 2.38.2, and 2.39.0 that allows unauthorized access to events due to improper configuration of Category Option Combination Sharing.

What is CVE-2023-32060?

DHIS2 Core's API endpoints

/trackedEntityInstances

and

/events

may expose all events regardless of sharing settings, potentially granting unauthorized access to sensitive data.

The Impact of CVE-2023-32060

This vulnerability could lead to unauthorized users accessing events they shouldn't have permissions for, compromising the confidentiality of sensitive data.

Technical Details of CVE-2023-32060

The vulnerability stems from the misconfiguration in Category Option Combination Sharing settings, allowing access to events irrespective of sharing settings.

Vulnerability Description

When the specific configuration is present, users may view events not meant for them, especially in the Android Capture App.

Affected Systems and Versions

DHIS2 Core versions >= 2.35 and < 2.36.13, >= 2.37 and < 2.37.8, >= 2.38 and < 2.38.2 are impacted by this vulnerability.

Exploitation Mechanism

Unauthorized users can exploit the misconfiguration to access events beyond their permissions, potentially compromising data confidentiality.

Mitigation and Prevention

To address CVE-2023-32060, immediate steps and long-term security practices are crucial.

Immediate Steps to Take

Upgrade to DHIS2 Core versions 2.36.13, 2.37.8, 2.38.2, or 2.39.0 to apply the necessary fix for this vulnerability.

Long-Term Security Practices

Regularly monitor and update Category Option Combination Sharing settings to ensure proper access controls and data security.

Patching and Updates

Stay informed about security advisories and promptly apply patches to mitigate risks associated with vulnerabilities like CVE-2023-32060.