CVE Feed

    Dashboard / CVE / CVE-2023-46126

    CVE-2023-46126

    Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.

    Published:Oct 24, 2023
    Last Modified:Nov 21, 2024
    EPS:Oct 24, 2023
    EPSS Score:0.00142
    CVSS Score:3.9

    Affected Products

    Vendor
    Ethyca
    Product
    Fides

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-44541 (CVSS 7) — Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a…
    CVE-2026-42303 (CVSS 6.1) — Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that ena…
    CVE-2025-57817 (CVSS 8.6) — Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and u…
    CVE-2025-57816 (CVSS 6.3) — Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built…
    CVE-2025-57766 (CVSS 1.7) — Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes …
    CVE-2025-57815 (CVSS 1.7) — Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoi…
    CVE-2024-52008 (CVSS 2) — Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-sid…
    CVE-2024-45053 (CVSS 9.1) — Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, …
    CVE-2024-45052 (CVSS 5.3) — Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumera…
    CVE-2024-31223 (CVSS 5.3) — Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High