PT-2023-25990 · Fides · Fides
Daveqnet
·
Published
2023-07-18
·
Updated
2023-07-27
·
CVE-2023-37480
CVSS v3.1
2.7
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Fides versions 2.11.0 through 2.15.1
Description
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. Exploitation is limited to users with elevated privileges with the
CONNECTOR TEMPLATE REGISTER scope, which includes root users and users with the owner role.Recommendations
For Fides versions 2.11.0 through 2.15.1, upgrade to Fides version 2.16.0 or later to secure your system against this threat. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container. As a temporary workaround, consider restricting access to the connector template upload feature until a patch is applied. Avoid using the
CONNECTOR TEMPLATE REGISTER scope in the affected API endpoint until the issue is resolved.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fides