How severe is CVE-2023-31139?

CVE-2023-31139 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2023-31139 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-31139?

CVE-2023-31139 affects Dhis2 Dhis 2. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-31139?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-31139 published?

CVE-2023-31139 was published on 2023-05-09 and last updated on 2026-06-17.

CVE-2023-31139

CVE-2023-31139 is a medium-severity vulnerability in Dhis2 Dhis 2 with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-613.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 1% (46th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-613
Affected product: Dhis2 Dhis 2
Published: 2023-05-09
Last modified: 2026-06-17

Description

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.

Frequently asked questions

What is CVE-2023-31139?: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access restrictions (for example, based on allowed IP addresses or HTTP methods). DHIS2 implementers should upgrade to a supported version of DHIS2: 2.37.9.1, 2.38.3.1, or 2.39.1.2. Implementers can work around this issue by adding extra access control validations on a reverse proxy.
How severe is CVE-2023-31139?: CVE-2023-31139 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2023-31139 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-31139?: CVE-2023-31139 affects Dhis2 Dhis 2. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-31139?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-31139 published?: CVE-2023-31139 was published on 2023-05-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*

More vulnerabilities in Dhis2 Dhis 2

CVE-2022-24848 — High (CVSS 8.8): DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection…
CVE-2021-39179 — High (CVSS 8.8): DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection…
CVE-2021-32704 — High (CVSS 8.5): DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection…
CVE-2021-41187 — High (CVSS 8.1): DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection…
CVE-2023-31138 — High (CVSS 7.1): DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the…
CVE-2022-41948 — Medium (CVSS 6.7): DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization.…

All CVEs affecting Dhis2 Dhis 2 →

Other CWE-613 (Insufficient Session Expiration) vulnerabilities

CVE-2024-8888 — Critical (CVSS 10.0): An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the…
CVE-2026-46455 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper…
CVE-2026-21622 — Critical (CVSS 9.8): Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module)…
CVE-2025-59786 — Critical (CVSS 9.8): 2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to…
CVE-2026-26342 — Critical (CVSS 9.8): Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token…
CVE-2026-1435 — Critical (CVSS 9.8): Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of…

Browse all CWE-613 (Insufficient Session Expiration) vulnerabilities →