PT-2025-36508 · Fides · Fides

Thabofletcher · Published 2025-09-08 · Updated 2025-09-08 · CVE-2025-57815

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.69.1

Description: Fides is an open-source privacy engineering platform. The Admin UI login endpoint relies on a general IP-based rate limit and lacks specific anti-automation controls, potentially allowing attackers to conduct credential testing attacks, such as credential stuffing or password spraying, against accounts with weak or previously compromised passwords.

Recommendations: Update to version 2.69.1 or later. For organizations with Fides Enterprise licenses, configure Single Sign-On (SSO) through an OIDC provider (like Azure, Google, or Okta) and disable username/password authentication.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-57815

GHSA-7Q62-R88R-J5GW

Affected Products

Fides

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57815.json · Exploit
• https://github.com/ethyca/fides/commit/59903c195e2f9f8915a1db94950aefd557033a5c · Patch
• https://github.com/ethyca/fides/security/advisories/GHSA-7q62-r88r-j5gw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57815 · Security Note
• https://osv.dev/vulnerability/GHSA-7q62-r88r-j5gw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57815 · Vendor Advisory
• https://github.com/ethyca/fides · Note
• https://github.com/ethyca/fides/releases/tag/2.69.1 · Note
• https://twitter.com/CVEnew/status/1965165482341703911 · Twitter Post
• https://t.me/cveNotify/134713 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1965200379160785225 · Twitter Post