Vulnerability in Ethyca Fides
CVE-2024-45052
Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system. This vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server's response time to authentication requests. This information can be used to conduct further attacks on authentication such as password brute-forcing and credential stuffing. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no workarounds.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (45.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Ethyca Fides — versions < 2.44.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/ethyca/fides/security/advisories/GHSA-2h46-8gf5-fmxv (Exploit, Vendor Advisory)
- github.com/ethyca/fides/commit/457b0e9df9f0d337133d6078bca6ed88bbc745f4 (Patch)
Frequently asked questions
- What is CVE-2024-45052?
- CVE-2024-45052 is a medium-severity vulnerability in Ethyca Fides, classified under CWE-208. CVSS score: 5.3/10. Published 2024-09-04.
- How severe is CVE-2024-45052?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-45052 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.