CVE-2023-46124
CVE-2023-46124 · Server-Side Request Forgery Vulnerability in Custom Integration Upload
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.
CVSS 8.2 · Высокий · EPSS 0,8% · Есть исправление
- Опубликовано
- Обновлено
Стек: python
Затронутые продукты и версии
fides
- Версии
- < 2.22.1: Затронуто
Нет опубликованного исправления
ethyca-fides PyPI
- Версии
- 1.9.9
- 2.0.0
- 2.1.0
- 2.10.0
- 2.11.0
- 2.12.0
- 2.12.1
- 2.13.0
- 2.14.0
- 2.14.1
- 2.14.2
- 2.15.0
- 2.15.1
- 2.16.0
- 2.17.0
- 2.17.1
- 2.18.0
- 2.19.0
- 2.19.1
- 2.2.0
- 2.2.1
- 2.2.2
- 2.20.0
- 2.20.1
- 2.20.2
- 2.21.0
- 2.22.0
- 2.3.0
- 2.3.1
- 2.4.0
- 2.5.0
- 2.5.1
- 2.6.0
- 2.6.1
- 2.6.2
- 2.6.3
- 2.6.4
- 2.6.5
- 2.6.6
- 2.7.0
- 2.7.1
- 2.8.0
- 2.8.1
- 2.8.2
- 2.8.3
- 2.9.0
- 2.9.1
- 2.9.2
- Затронутые диапазоны версий
- ECOSYSTEM: < 2.22.1
Обновитесь до 2.22.1