XSS in Ethyca Fides
CVE-2023-46126
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.006 (48.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Ethyca Fides — versions < 2.22.1
Weakness classification (CWE)
References
- github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83 (Third Party Advisory)
- github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506 (Patch)
- github.com/ethyca/fides/releases/tag/2.22.1 (Release Notes)
Frequently asked questions
- What is CVE-2023-46126?
- CVE-2023-46126 is a low-severity vulnerability in Ethyca Fides, classified under Cross-site Scripting. CVSS score: 3.9/10. Published 2023-10-25.
- How severe is CVE-2023-46126?
- Low severity. CVSS v3 base score is 3.9 out of 10.