CVE-2023-46126

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ethyca	fides	< 2.22.1

References

https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506Patch
https://github.com/ethyca/fides/releases/tag/2.22.1Release Notes
https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83Third Party Advisory
https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506Patch
https://github.com/ethyca/fides/releases/tag/2.22.1Release Notes
https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83Third Party Advisory

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-461275.4Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A ma CVE-2023-461286.5Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. I CVE-2023-461297.5NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge compu CVE-2023-46139.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG LED Assistant. Authentication is not re CVE-2023-461305.4Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the CVE-2023-461317.5Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM CVE-2023-461326.5Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linkin CVE-2023-461339.1CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times wea CVE-2023-461349.8D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users CVE-2023-461357.5rs-stellar-strkey is a Rust lib for encode/decode of Stellar Strkeys. A panic vulnerability occurs when a specially crafted payload is used.CVE-2023-461367.5Werkzeug is a comprehensive WSGI web application library. In versions on the 3.x branch prior to 3.0.1 and on the 2.x branch prior to 2.3.8,CVE-2023-461375.3Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP p