PT-2023-29859 · Fides · Fides

Aveqnet · Publicado 2023-10-24 · Atualizado 2023-11-01 · CVE-2023-46126

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Baixa

Vetor base

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1

Description The Fides web application allows users to edit consent and privacy notices, such as cookie banners. A vulnerability exists where a crafted payload in the privacy policy URL can trigger JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher.

Recommendations For versions prior to 2.22.1, upgrade to version 2.22.1 or later to secure the system against this threat. As a temporary workaround, consider restricting access to the Admin UI for users with the contributor role or higher until the upgrade is applied. Avoid using the privacy policy URL field in the Fides web application until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46126

GHSA-FGJJ-5JMR-GH83

Produtos afetados

Fides

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46126.json · Exploit
• https://github.com/ethyca/fides · Nota
• https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83 · Nota
• https://github.com/ethyca/fides/releases/tag/2.22.1 · Nota
• https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506 · Correção
• https://twitter.com/CVEnew/status/1716941224467222907 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-46126 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-46126 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fgjj-5jmr-gh83 · Aviso do Fabricante