Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
50Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 5.3epss 1.1%
from disclosure to weapon
Published on NVDJul 3
VulnCheckJun 13
exploitation probability
1.1%top 37% of all CVEs
observed exploitation
yesVulnCheck
In short
A vulnerability in Fides Privacy Center allows attackers to discover the private server URL configuration through an unauthenticated HTTP request, exposing sensitive information like internal IP addresses and ports.
Technical detail
An information disclosure vulnerability (CWE-497) in Fides versions 2.19.0 through 2.39.1 permits unauthenticated attackers to retrieve the SERVER_SIDE_FIDES_API_URL environment variable value via HTTP GET requests to the Privacy Center, disclosing backend infrastructure details including private IPs, domain names, and ports. Fixed in version 2.39.2rc0.
Summary generated and translated by AI from the official description.
Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
ethyca · fides