CVE-2023-46126

    Dashboard / Vulnerabilities / CVE-2023-46126

    CVE-2023-46126

    Published: 24 Oct 2023Last Modified: 28 Oct 2026

    Summary: Fides JavaScript Injection Vulnerability in Privacy Center URL

    Details: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.

    References: https://github.com/ethyca/fides/releases/tag/2.22.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46126.json, https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83, https://nvd.nist.gov/vuln/detail/CVE-2023-46126, https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -dfb7dfd0ba1f6ba6963396dd4d63b05dddd82dd5

    Affected versions

    2.22.0rc5
    2.22.0
    2.22.0rc4
    2.22.0rc3
    2.22.0rc2
    2.22.0rc1
    2.22.0rc0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46126 | CVE-DB