CVE-2026-55081highCWE-79

CVE-2026-55081: falha de alta gravidade em dhis2-core

DHIS2 Reflected XSS in OpenAPI HTML scope parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar dhis2-core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.3epss 0.4%
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin. Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
dhis2 · dhis2-core
CVEs relacionadas — dhis2-core

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39179HIGHSQL Injection in DHIS2 Tracker APIEPSS 1.9%CVE-2022-24848HIGHSQL Injection in DHIS2's in OrgUnit program associationEPSS 1.2%CVE-2021-41187HIGHSQL Injection in DHIS2 Tracker APIEPSS 0.9%CVE-2021-32704HIGHImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-coreEPSS 0.8%CVE-2022-41948MEDIUMPrivilege Chaining with the user admin role in dhis2-coreEPSS 0.6%CVE-2023-31139MEDIUMDHIS2 Core unrestricted session cookies with Personal Access TokensEPSS 0.6%