LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32704: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2, 2.35.3, 2.35.4, and 2.36.0. Earlier versions, such as 2.34.3 and 2.35.1 and all versions 2.33 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. However, we strongly recommend that all DHIS2 implementations using versions 2.34, 2.35 and 2.36 install these patches as soon as possible. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the /api/trackedEntityInstance endpoint as a temporary workaround while waiting to upgrade.

HighCVSS 8.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A logged-in DHIS2 user could abuse a SQL injection flaw in affected DHIS2 Tracker API versions to read, change, or delete data. The issue is high urgency for organizations using DHIS2 2.34.4, 2.35.2-2.35.4, or 2.36.0, especially where sensitive health or program data is stored.

Executive priority

Treat as high priority if affected DHIS2 versions are in production. The business concern is not public unauthenticated compromise, but trusted-account misuse or account takeover leading to unauthorized access, modification, or deletion of DHIS2 data.

Technical view

CVE-2021-32704 is CWE-89 SQL injection in DHIS2 Core’s /api/trackedEntityInstances endpoint. Affected versions are 2.34.4, 2.35.2 through 2.35.4, and 2.36.0. Exploitation requires a logged-in DHIS2 user, has high confidentiality, integrity, and availability impact, and is scored CVSS 3.1 8.5.

Likely exposure

Exposure is limited to DHIS2 deployments running the affected versions and reachable by authenticated DHIS2 users. Deployments using Tracker functionality are most operationally relevant because the affected endpoint is part of that workflow. Earlier versions 2.34.3, 2.35.1, and 2.33 or older are reported unaffected.

Exploitation context

The provided sources state there is no known unauthenticated exploitation path and no known exploits for the addressed vulnerabilities. This CVE is not listed as KEV in the supplied bundle. Risk remains material because any valid DHIS2 account could become a path to serious data compromise.

Researcher notes

CVSS vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The source bundle does not provide exploit mechanics, and none should be inferred. Scope validation should focus on version, Tracker usage, endpoint reachability, authenticated user population, and confirmation of the fixed branch release.

Mitigation direction

  • Upgrade affected DHIS2 servers to the fixed patch release for the deployed branch.
  • For Tracker deployments, do not rely on a workaround; prioritize the vendor patch.
  • For non-Tracker deployments, temporarily block POST access to /api/trackedEntityInstance if upgrade is delayed.
  • Review vendor advisory guidance before applying compensating controls.
  • Limit DHIS2 accounts to users with a current business need.

Validation and detection

  • Confirm the DHIS2 server version against the affected ranges.
  • Determine whether Tracker functionality is enabled or operationally required.
  • Verify the /api/trackedEntityInstances endpoint is not exposed unnecessarily to authenticated users.
  • Confirm upgrade completion to 2.34.5, 2.35.5, 2.36.1, or later applicable releases.
  • Check whether any temporary POST block was applied only where Tracker is unused.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-89: Database access and collection lookup

Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32704 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.5CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H1.86Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.5High
CVSS 3.1 vector shape for CVE-2021-32704Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
dhis2dhis2-core>= 2.34.4, < 2.34.5, >= 2.35.2, < 2.35.5, >= 2.36.0, < 2.36.1Listed
Weakness

CWE details

CWE-89

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-89 · source CWE mapping

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs