CVE-2023-46124

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.

• CWE-918
• CWE-918

• https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1eePatch
• https://github.com/ethyca/fides/releases/tag/2.22.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4Third Party Advisory
• https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1eePatch
• https://github.com/ethyca/fides/releases/tag/2.22.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4Third Party Advisory

Published

Oct 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46119Parse Server is an open source backend that can be deployed …7.5
• CVE-2023-4612Improper Authentication vulnerability in Apereo CAS in jakar…9.8
• CVE-2023-46120The RabbitMQ Java client library allows Java and JVM-based a…7.5
• CVE-2023-46121yt-dlp is a youtube-dl fork with additional features and fix…3.7
• CVE-2023-46122sbt is a build tool for Scala, Java, and others. Given a spe…7.1
• CVE-2023-46123jumpserver is an open source bastion machine, professional o…5.3
• CVE-2023-46125Fides is an open-source privacy engineering platform for man…6.5
• CVE-2023-46126Fides is an open-source privacy engineering platform for man…5.4
• CVE-2023-46127Frappe is a full-stack web application framework that uses P…5.4
• CVE-2023-46128Nautobot is a Network Automation Platform built as a web app…6.5
• CVE-2023-46129NATS.io is a high performance open source pub-sub distribute…7.5
• CVE-2023-4613This vulnerability allows remote attackers to execute arbitr…9.8