CVE-2023-46125: falha de média gravidade em ethyca fides
Fides Information Disclosure Vulnerability in Config API Endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.9%
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. The vulnerability has been patched in Fides version `2.22.1`.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ethyca · fidesCVEs relacionadas — ethyca fides
No mesmo produto, das mais perigosas para as menos.
CVE-2023-36827HIGHFides vulnerable to Path Traversal in Webserver APIEPSS 1.5%CVE-2024-38537NONEInclusion of Untrusted polyfill.io Code Vulnerability in fides.jsEPSS 1.4%CVE-2024-45053CRITICALRemote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating EngineEPSS 1.3%CVE-2024-31223MEDIUMFides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URLEPSS 1.1%CVE-2023-48224HIGHCryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fidesEPSS 1.0%CVE-2023-41319HIGHRemote Code Execution in Custom Integration Upload in FidesEPSS 0.9%