CVE-2023-46124

CVSS 3.1 Score 7.2 of 10 (high)

Details

Published Oct 25, 2023

Updated: Nov 1, 2023

CWE ID 918

Summary

CVE-2023-46124 is a vulnerability affecting the Fides open-source privacy engineering platform. Maliciously crafted YAML files used in custom integrations can bypass the application's validation, enabling attackers to perform arbitrary requests to internal systems and exfiltrate data. The vulnerability, known as Server-Side Request Forgery (SSRF), allows unauthorized access to internal resources, including localhost. This issue has been addressed in Fides version 2.22.1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Ethyca Fides

Affected Vendors

Ethyca

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/tCGFR6
https://www.cve.org/CVERecord?id=CVE-2023-46124
https://nvd.nist.gov/vuln/detail/CVE-2023-46124

Back to Vulnerability Database