PT-2023-30319 · Fides · Fides

H0Wl + 1 · Publicado 2023-11-08 · Atualizado 2023-11-16 · CVE-2023-47114

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.23.3

Description The Fides web application is vulnerable to an HTML injection issue due to the lack of validation of input coming from connected systems and data stores. This can result in malicious JavaScript code execution or phishing attacks when a data subject user accesses an HTML page using the file:// protocol. Exploitation is limited to rogue Admin UI users, malicious connected system or data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves.

Recommendations For versions prior to 2.23.3, upgrade to version 2.23.3 or later to secure the system against this threat. As a temporary workaround, consider configuring the storage destination to use json or csv instead of html as the package format to eliminate this vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-47114

GHSA-3VPF-MCJ7-5H38

Produtos afetados

Fides

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47114.json · Exploit
• https://github.com/ethyca/fides · Nota
• https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1 · Correção
• https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38 · Aviso do Fabricante
• https://github.com/ethyca/fides/releases/tag/2.23.3 · Nota
• https://twitter.com/CVEnew/status/1722377154682622439 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-47114 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1722401149804830983 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-47114 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3vpf-mcj7-5h38 · Aviso do Fabricante