{"kind": "product", "path": "vulns/pypi/ethyca-fides", "name": "ethyca-fides", "product": "ethyca-fides", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-44541", "noindex": false, "published": "2026-06-08T20:01:54.675Z", "modified": "2026-06-09T12:57:22.457Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00297, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44541", "title": "Fides: DOM-based XSS vulnerability in fides.js via fides_description override", "description": "Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2", "https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd", "https://github.com/ethyca/fides/releases/tag/2.84.5"], "fixes": ["2.84.5"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-42303", "noindex": false, "published": "2026-05-12T17:29:22.285Z", "modified": "2026-05-12T18:40:09.815Z", "cvss": 6.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N", "severity": "medium", "epss": 0.00309, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-42303", "title": "Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection", "description": "Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result in unauthorized deletion of a data subject's records across every integration configured in the affected deployment. This vulnerability is fixed in 2.83.2.", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-qx5f-ghc2-7g5c", "https://github.com/ethyca/fides/pull/7971", "https://github.com/ethyca/fides/pull/7972"], "fixes": ["2.83.2"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-57817", "noindex": false, "published": "2025-09-08T21:17:09.105Z", "modified": "2025-09-09T13:39:00.895Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0042, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-57817", "title": "Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation", "description": "Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to owner-level. Version 2.69.1 fixes the issue. No known workarounds are available.", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-hjfh-p8f5-24wr", "https://github.com/ethyca/fides/commit/2ffd125e1089a09b84c27fb5279a05960cbf2452", "https://github.com/ethyca/fides/releases/tag/2.69.1"], "fixes": ["2.69.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-57816", "noindex": false, "published": "2025-09-08T21:14:06.853Z", "modified": "2025-09-09T14:19:27.430Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00435, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-57816", "title": "Fides Webserver API Rate Limiting Vulnerability in Proxied Environments", "description": "Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a shared store. This allows attackers to bypass intended rate limits and potentially cause denial of service. This vulnerability only affects deployments relying on Fides's built-in rate limiting for protection. Deployments using external rate limiting solutions (WAFs, API gateways, e", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-fq34-xw6c-fphf", "https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c", "https://github.com/ethyca/fides/releases/tag/2.69.1"], "fixes": ["2.69.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-57766", "noindex": false, "published": "2025-09-08T21:12:07.626Z", "modified": "2025-09-09T13:45:07.885Z", "cvss": 1.7, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-57766", "title": "Fides's Admin UI User Password Change Does Not Invalidate Current Session", "description": "Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-rpw8-82v9-3q87", "https://github.com/ethyca/fides/commit/8daec4f5ad3daf0f0bdab4814f6757eb0965104b", "https://github.com/ethyca/fides/releases/tag/2.69.1"], "fixes": ["2.69.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2025-57815", "noindex": false, "published": "2025-09-08T21:11:53.369Z", "modified": "2025-09-09T13:44:06.409Z", "cvss": 1.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "severity": "low", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2025-57815", "title": "Fides Lacks Brute-Force Protections on Authentication Endpoints", "description": "Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential stuffing or password spraying, which poses a risk to accounts with weak or previously compromised passwords. Version 2.69.1 fixes the issue. For organizations with commercial Fides Enterprise licenses, configuring Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) is an eff", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-7q62-r88r-j5gw", "https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c", "https://github.com/ethyca/fides/releases/tag/2.69.1"], "fixes": ["2.69.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-52008", "noindex": false, "published": "2024-11-26T18:52:40.102Z", "modified": "2024-11-26T19:16:54.451Z", "cvss": 2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00557, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-52008", "title": "Password Policy Bypass Vulnerability in Fides Webserver", "description": "Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of accounts with passwords as short as a single character. When an email messaging provider is enabled and a new user account is created in the system, an invite email containing a special link is sent to the new user's email address. This link directs the new user to a page where they can set thei", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-v7vm-rhmg-8j2r", "https://nvd.nist.gov/vuln/detail/CVE-2024-52008"], "fixes": ["2.50.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-45053", "noindex": false, "published": "2024-09-04T16:04:03.741Z", "modified": "2024-09-04T18:02:37.351Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.01342, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-45053", "title": "Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine", "description": "Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default `Owner` or `Contributor` role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upg", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-c34r-238x-f7qx", "https://github.com/ethyca/fides/commit/829cbd9cb5ef9c814fbac1ed6800e8d939d359c5", "https://nvd.nist.gov/vuln/detail/CVE-2024-45053"], "fixes": ["2.44.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-45052", "noindex": false, "published": "2024-09-04T15:43:52.056Z", "modified": "2024-09-04T16:19:47.481Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00557, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-45052", "title": "Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability", "description": "Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system. This vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server's response ti", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-2h46-8gf5-fmxv", "https://github.com/ethyca/fides/commit/457b0e9df9f0d337133d6078bca6ed88bbc745f4", "https://nvd.nist.gov/vuln/detail/CVE-2024-45052"], "fixes": ["2.44.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-31223", "noindex": false, "published": "2024-07-03T17:34:48.508Z", "modified": "2024-08-02T01:46:04.901Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.01105, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-31223", "title": "Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL", "description": "Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on ", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg", "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097", "https://nvd.nist.gov/vuln/detail/CVE-2024-31223"], "fixes": ["2.39.2"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-38537", "noindex": false, "published": "2024-07-02T19:50:10.275Z", "modified": "2024-08-02T04:12:24.976Z", "cvss": 0, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "severity": "low", "epss": 0.01427, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-38537", "title": "Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js", "description": "Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving `fides.js` to download and execute malicious scripts from the `polyfill.io` domain when the domain was compromised and serving malware. No exploitation of `fides.js` via `polyfill.io` has been identified as of time of publication.\n\nThe vulnerability has be", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-cvw4-c69g-7v7m", "https://github.com/ethyca/fides/pull/5026", "https://github.com/ethyca/fides/commit/868c4d629760572192bd61db34f5a4458ed12005"], "fixes": ["2.39.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-35189", "noindex": false, "published": "2024-05-30T19:47:43.080Z", "modified": "2024-08-02T03:07:46.734Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00582, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-35189", "title": "Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides", "description": "Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. Th", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7c", "https://cloud.google.com/iam/docs/key-rotation", "https://nvd.nist.gov/vuln/detail/CVE-2024-35189"], "fixes": ["2.37.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-34715", "noindex": false, "published": "2024-05-29T16:35:46.375Z", "modified": "2024-08-02T02:59:22.619Z", "cvss": 2.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00275, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-34715", "title": "Partial Password Exposure Vulnerability in Fides Webserver Logs", "description": "Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver startup fails and the part of the password following the special character is exposed in webserver error logs. This is caused by improper escaping of the SQLAlchemy password string. As a result users are subject to a partial exposure of hosted database password in webserver logs. The vulnerability has been patched in Fides version `2.37.0`. Users are", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7", "https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c", "https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords"], "fixes": ["2.37.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-48224", "noindex": false, "published": "2023-11-15T20:53:19.590Z", "modified": "2024-08-29T15:02:52.052Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "severity": "high", "epss": 0.00992, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-48224", "title": "Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides", "description": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests allow data subjects to submit a request to access all person data held by the data controller, or delete/erase it.  Consent request allows data subject users to modify their privacy preferences for how the data controller uses their personal data e.g. data sales and sharing consent opt-in/opt-out. If `", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-82vr-5769-6358", "https://github.com/ethyca/fides/commit/685bae61c203d29ed189f4b066a5223a9bb774c6", "https://peps.python.org/pep-0506/"], "fixes": ["2.24.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-47114", "noindex": false, "published": "2023-11-08T21:50:45.465Z", "modified": "2024-09-04T14:04:23.644Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00609, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-47114", "title": "Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages", "description": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most c", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38", "https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1", "https://github.com/ethyca/fides/releases/tag/2.23.3"], "fixes": ["2.23.3"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-46124", "noindex": false, "published": "2023-10-24T22:51:55.128Z", "modified": "2024-09-11T13:21:00.478Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L", "severity": "high", "epss": 0.00839, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-46124", "title": "Server-Side Request Forgery Vulnerability in Custom Integration Upload", "description": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to ", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4", "https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee", "https://github.com/ethyca/fides/releases/tag/2.22.1"], "fixes": ["2.22.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-46125", "noindex": false, "published": "2023-10-24T22:42:05.651Z", "modified": "2024-09-11T13:23:33.012Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00919, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-46125", "title": "Fides Information Disclosure Vulnerability in Config API Endpoint", "description": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as we", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-rjxg-rpg3-9r89", "https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06", "https://github.com/ethyca/fides/releases/tag/2.22.1"], "fixes": ["2.22.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-46126", "noindex": false, "published": "2023-10-24T21:59:30.055Z", "modified": "2024-09-17T14:15:58.558Z", "cvss": 3.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L", "severity": "low", "epss": 0.0067, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-46126", "title": "Fides JavaScript Injection Vulnerability in Privacy Center URL", "description": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in F", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83", "https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506", "https://github.com/ethyca/fides/releases/tag/2.22.1"], "fixes": ["2.22.1"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-41319", "noindex": false, "published": "2023-09-06T17:54:30.889Z", "modified": "2024-09-26T19:31:57.634Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00936, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-41319", "title": "Remote Code Execution in Custom Integration Upload in Fides", "description": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code. The vulnerability allows the execution of arbitrary code on the target system within the context of the webserver python process", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-p6p2-qq95-vq5h", "https://github.com/ethyca/fides/commit/5989b5fa744c8d8c340963b895a054883549358a", "https://nvd.nist.gov/vuln/detail/CVE-2023-41319"], "fixes": ["2.19.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}, {"id": "CVE-2023-37480", "noindex": false, "published": "2023-07-18T18:19:17.956Z", "modified": "2024-10-18T17:22:39.902Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00685, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2023-37480", "title": "Fides Webserver Vulnerable to Zip Bomb File Uploads", "description": "Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability h", "references": ["https://github.com/ethyca/fides/security/advisories/GHSA-g95c-2jgm-hqc6", "https://github.com/ethyca/fides/commit/5aea738463960d81821c11ae7ade1d627a46bf32", "https://nvd.nist.gov/vuln/detail/CVE-2023-37480"], "fixes": ["2.16.0"], "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}]}], "total": 22, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "ethyca-fides", "path": "vulns/pypi/ethyca-fides", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-06-09T12:57:22.457Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}