CVE-2022-41949

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources (like third party servers). This could allow an attacker, for example, to identify vulnerable services which might not be otherwise exposed to the public internet or to determine whether a specific file is present on the DHIS2 server. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. At this time, there is no known workaround or mitigation for this vulnerability.

• CWE-918

• https://github.com/dhis2/dhis2-core/commit/dc3166c216da53e12a16bfdc51055823b838c1c3Patch, Third Party Advisory
• https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6qh9-rxc8-7943Third Party Advisory
• https://github.com/dhis2/dhis2-core/commit/dc3166c216da53e12a16bfdc51055823b838c1c3Patch, Third Party Advisory
• https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6qh9-rxc8-7943Third Party Advisory

Published

Dec 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41943sourcegraph is a code intelligence platform. As a site admin…7.2
• CVE-2022-41944Discourse is an open-source discussion platform. In stable v…4.3
• CVE-2022-41945super-xray is a vulnerability scanner (xray) GUI launcher. I…9.8
• CVE-2022-41946pgjdbc is an open source postgresql JDBC Driver. In affected…5.5
• CVE-2022-41947DHIS 2 is an open source information system for data capture…5.4
• CVE-2022-41948DHIS 2 is an open source information system for data capture…7.2
• CVE-2022-4195Insufficient policy enforcement in Safe Browsing in Google C…4.3
• CVE-2022-41950super-xray is the GUI alternative for vulnerability scanning…7.8
• CVE-2022-41951OroPlatform is a PHP Business Application Platform (BAP) des…9.8
• CVE-2022-41952Synapse before 1.52.0 with URL preview functionality enabled…5.3
• CVE-2022-41953Git GUI is a convenient graphical tool that comes with Git f…7.8
• CVE-2022-41954MPXJ is an open source library to read and write project pla…3.3