CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46125 – Fides Information Disclosure Vulnerability in Config API Endpoint
https://notcve.org/view.php?id=CVE-2023-46125
24 Oct 2023 — Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructur... • https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46126 – Fides JavaScript Injection Vulnerability in Privacy Center URL
https://notcve.org/view.php?id=CVE-2023-46126
24 Oct 2023 — Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the ... • https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41319 – Remote Code Execution in Custom Integration Upload in Fides
https://notcve.org/view.php?id=CVE-2023-41319
06 Sep 2023 — Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitr... • https://github.com/ethyca/fides/commit/5989b5fa744c8d8c340963b895a054883549358a • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-693: Protection Mechanism Failure •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37480 – Fides Webserver Vulnerable to Zip Bomb File Uploads
https://notcve.org/view.php?id=CVE-2023-37480
18 Jul 2023 — Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elev... • https://github.com/ethyca/fides/commit/5aea738463960d81821c11ae7ade1d627a46bf32 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37481 – Fides Webserver Vulnerable to SVG Bomb File Uploads
https://notcve.org/view.php?id=CVE-2023-37481
18 Jul 2023 — Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides ve... • https://github.com/ethyca/fides/commit/8beaace082b325e693dc7682029a3cb7e6c2b69d • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36827 – Fides vulnerable to Path Traversal in Webserver API
https://notcve.org/view.php?id=CVE-2023-36827
05 Jul 2023 — Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal (directory traversal) vulnerability affects fides versions lower than version `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem. The vulnerability is patched in fides `2.15.1`. If the Fides webserver API is not directly accessible to attackers and is i... • https://github.com/ethyca/fides/commit/f526d9ffb176006d701493c9d0eff6b4884e811f • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •