CVE-2022-41947

    Dashboard / Vulnerabilities / CVE-2022-41947

    CVE-2022-41947

    Published: 8 Dec 2022Last Modified: 12 Aug 2026

    Summary: Cross-site Scripting with user-uploaded files in dhis2-core

    Details: DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated user to open the malicious file in a browser which would trigger the javascript code, resulting in a cross-site scripting (XSS) attack. DHIS2 administrators should upgrade to the following hotfix releases: 2.36.12.1, 2.37.8.1, 2.38.2.1, 2.39.0.1. Users unable to upgrade may add the following simple CSP rule in your web proxy to the vulnerable endpoints: `script-src 'none'`. This workaround will prevent all javascript from running on those endpoints.

    References: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41947.json, https://github.com/dhis2/dhis2-core/security/advisories/GHSA-763w-rm78-6xcg, https://nvd.nist.gov/vuln/detail/CVE-2022-41947

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4219a14c2b2ad021231a00b1c9607e5ab6e514fd
    Fixed -7368011a1ffef0d18a100b6cbc908e76ed05cc81

    Affected versions

    2.39.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-41947 | CVE-DB