CVE-2026-55081

{
  "id": "CVE-2026-55081",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T19:17:10.950",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin.\n\nAffected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged.\nPatched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch."
    },
    {
      "lang": "es",
      "value": "DHIS2 es un sistema de información flexible para la captura, gestión, validación, análisis y visualización de datos. El endpoint HTML de OpenAPI de DHIS2 reflejaba valores del parámetro de consulta ’scope’ en el documento HTML generado sin una sanitización suficiente. Un valor de ’scope’ manipulado podría ser renderizado como HTML o JavaScript activo en la página de documentación de OpenAPI. Un atacante capaz de lograr que un usuario abriera una URL HTML de OpenAPI manipulada podría ejecutar JavaScript en el navegador de ese usuario en el origen de DHIS2.\n\nVersiones afectadas: DHIS2 2.42 y 2.43 antes de las versiones del parche de seguridad del 09-06-2026, y la rama de desarrollo para DHIS2 2.44 antes de que se fusionara la corrección.\nParcheado en 2.42.5.1, 2.43.0.1, las ramas de línea 2.42 y 2.43, y la rama de desarrollo 2.44."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "dhis2",
          "product": "dhis2-core",
          "versions": [
            {
              "version": ">= 2.42.0, < 2.42.5.1",
              "status": "affected"
            },
            {
              "version": ">= 2.43.0, < 2.43.0.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T14:38:55.714622Z",
          "id": "CVE-2026-55081",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dhis2/dhis2-core/pull/24158",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/pull/24159",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/pull/24160",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/pull/24161",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/pull/24162",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-6785-hj47-c27h",
      "source": "[email protected]"
    }
  ]
}