CVE-2023-47114

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. This vulnerability has been patched in version 2.23.3.

• CWE-79

• https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1Patch
• https://github.com/ethyca/fides/releases/tag/2.23.3Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38Vendor Advisory
• https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1Patch
• https://github.com/ethyca/fides/releases/tag/2.23.3Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38Vendor Advisory

Published

Nov 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47109PrestaShop blockreassurance adds an information block aimed …8.1
• CVE-2023-4711A vulnerability, which was classified as critical, has been …8.1
• CVE-2023-47110blockreassurance adds an information block aimed at offering…5.3
• CVE-2023-47111ZITADEL provides identity infrastructure. ZITADEL provides a…3.7
• CVE-2023-47112Rundeck is an open source automation service with a web cons…4.3
• CVE-2023-47113BleachBit cleans files to free disk space and to maintain pr…7.3
• CVE-2023-47115Label Studio is an a popular open source data labeling tool.…5.4
• CVE-2023-47116Label Studio is a popular open source data labeling tool. Th…5.3
• CVE-2023-47117Label Studio is an open source data labeling tool. In all cu…7.5
• CVE-2023-47118ClickHouse® is an open-source column-oriented database manag…9.8
• CVE-2023-47119Discourse is an open source platform for community discussio…6.1
• CVE-2023-4712A vulnerability, which was classified as critical, was found…9.8