CVE-2025-57816mediumCWE-799

CVE-2025-57816: falha de média gravidade em ethyca fides

Fides Webserver API Rate Limiting Vulnerability in Proxied Environments

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar fides+ Monitorar ethyca-fides

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a shared store. This allows attackers to bypass intended rate limits and potentially cause denial of service. This vulnerability only affects deployments relying on Fides's built-in rate limiting for protection. Deployments using external rate limiting solutions (WAFs, API gateways, etc.) are not affected. Version 2.69.1 fixes the issue. There are no application-level workarounds. However, rate limiting may instead be implemented externally at the infrastructure level using a WAF, API Gateway, or similar technology.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
ethyca · fides
CVEs relacionadas — ethyca fides

No mesmo produto, das mais perigosas para as menos.

CVE-2023-36827HIGHFides vulnerable to Path Traversal in Webserver APIEPSS 1.5%CVE-2024-38537NONEInclusion of Untrusted polyfill.io Code Vulnerability in fides.jsEPSS 1.4%CVE-2024-45053CRITICALRemote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating EngineEPSS 1.3%CVE-2024-31223MEDIUMFides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URLEPSS 1.1%CVE-2023-48224HIGHCryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fidesEPSS 1.0%CVE-2023-41319HIGHRemote Code Execution in Custom Integration Upload in FidesEPSS 0.9%