PT-2023-29859 · Fides · Fides

Aveqnet · Published 2023-10-24 · Updated 2023-11-01 · CVE-2023-46126

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.22.1

Description The Fides web application allows users to edit consent and privacy notices, such as cookie banners. A vulnerability exists where a crafted payload in the privacy policy URL can trigger JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher.

Recommendations For versions prior to 2.22.1, upgrade to version 2.22.1 or later to secure the system against this threat. As a temporary workaround, consider restricting access to the Admin UI for users with the contributor role or higher until the upgrade is applied. Avoid using the privacy policy URL field in the Fides web application until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46126

GHSA-FGJJ-5JMR-GH83

Affected Products

Fides

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46126.json · Exploit
• https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46126 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46126 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fgjj-5jmr-gh83 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83 · Note
• https://github.com/ethyca/fides/releases/tag/2.22.1 · Note
• https://twitter.com/CVEnew/status/1716941224467222907 · Twitter Post