PT-2025-36509 · Fides · Fides

Daveqnet · Publicado 2025-09-08 · Atualizado 2025-09-08 · CVE-2025-57816

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.69.1

Description: Fides is an open-source privacy engineering platform. The built-in IP-based rate limiting in the Fides Webserver API is ineffective in environments utilizing CDNs, proxies, or load balancers. The system incorrectly applies rate limits based on infrastructure IPs instead of client IPs and stores counters in memory rather than a shared store. This allows attackers to bypass rate limits and potentially cause a denial of service. Deployments using external rate limiting solutions are not affected.

Recommendations: Update to version 2.69.1 or later. Implement rate limiting externally at the infrastructure level using a WAF, API Gateway, or similar technology.

Exploit

Correção

DoS

Improper Restriction of Excessive Authentication Attempts

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-799

CWE-307

CWE-770

Identificadores relacionados

CVE-2025-57816

GHSA-FQ34-XW6C-FPHF

Produtos afetados

Fides

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57816.json · Exploit
• https://github.com/ethyca/fides · Nota
• https://github.com/ethyca/fides/security/advisories/GHSA-fq34-xw6c-fphf · Aviso do Fabricante
• https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c · Correção
• https://github.com/ethyca/fides/releases/tag/2.69.1 · Nota
• https://twitter.com/CVEnew/status/1965165479967777057 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-fq34-xw6c-fphf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-57816 · Nota de Segurança
• https://t.me/cveNotify/134714 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-57816 · Aviso do Fabricante