PT-2023-30319 · Fides · Fides

H0Wl + 1 · Published 2023-11-08 · Updated 2023-11-16 · CVE-2023-47114

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Fides versions prior to 2.23.3

Description The Fides web application is vulnerable to an HTML injection issue due to the lack of validation of input coming from connected systems and data stores. This can result in malicious JavaScript code execution or phishing attacks when a data subject user accesses an HTML page using the file:// protocol. Exploitation is limited to rogue Admin UI users, malicious connected system or data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves.

Recommendations For versions prior to 2.23.3, upgrade to version 2.23.3 or later to secure the system against this threat. As a temporary workaround, consider configuring the storage destination to use json or csv instead of html as the package format to eliminate this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47114

GHSA-3VPF-MCJ7-5H38

Affected Products

Fides

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47114.json · Exploit
• https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1 · Patch
• https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47114 · Security Note
• https://osv.dev/vulnerability/GHSA-3vpf-mcj7-5h38 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://github.com/ethyca/fides/releases/tag/2.23.3 · Note
• https://twitter.com/CVEnew/status/1722377154682622439 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1722401149804830983 · Twitter Post