CVE-2023-46124

    Dashboard / Vulnerabilities / CVE-2023-46124

    CVE-2023-46124

    Published: 24 Oct 2023Last Modified: 28 Oct 2026

    Summary: Server-Side Request Forgery Vulnerability in Custom Integration Upload

    Details: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.

    References: https://github.com/ethyca/fides/releases/tag/2.22.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46124.json, https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4, https://nvd.nist.gov/vuln/detail/CVE-2023-46124, https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -dfb7dfd0ba1f6ba6963396dd4d63b05dddd82dd5

    Affected versions

    2.22.0rc5
    2.22.0
    2.22.0rc4
    2.22.0rc3
    2.22.0rc2
    2.22.0rc1
    2.22.0rc0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46124 | CVE-DB