p PatchFirst

CVE-2023-46124

CVE-2023-46124 · Server-Side Request Forgery Vulnerability in Custom Integration Upload

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.

CVSS 8.2 · Alta · EPSS 0,8% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • fides

    Versiones
    • < 2.22.1: Afectada

    Sin corrección publicada

  • ethyca-fides PyPI

    Versiones
    • 1.9.9
    • 2.0.0
    • 2.1.0
    • 2.10.0
    • 2.11.0
    • 2.12.0
    • 2.12.1
    • 2.13.0
    • 2.14.0
    • 2.14.1
    • 2.14.2
    • 2.15.0
    • 2.15.1
    • 2.16.0
    • 2.17.0
    • 2.17.1
    • 2.18.0
    • 2.19.0
    • 2.19.1
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.20.0
    • 2.20.1
    • 2.20.2
    • 2.21.0
    • 2.22.0
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.6.3
    • 2.6.4
    • 2.6.5
    • 2.6.6
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.8.1
    • 2.8.2
    • 2.8.3
    • 2.9.0
    • 2.9.1
    • 2.9.2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.22.1

    Actualiza a 2.22.1

Fuentes originales

Comprueba tu servidor →