Resource exhaustion in Ethyca Fides

CVE-2023-37481

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.

Vulnerability class: DoS (Denial of Service)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.007 (52.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 52.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2023-37481: held from 0.007 to 0.007.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2023-37481?
CVE-2023-37481 is a low-severity vulnerability in Ethyca Fides, classified under Uncontrolled Resource Consumption. CVSS score: 2.7/10. Published 2023-07-18.
How severe is CVE-2023-37481?
Low severity. CVSS v3 base score is 2.7 out of 10.