Cyber Resilience

CVE-2023-46125

Medium

Published: 25 October 2023

Published
25 October 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0018 39.3th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-46125 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Ethyca Fides. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Network Configuration Discovery (T1016); ranked at the 39.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET…

more

api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. The vulnerability has been patched in Fides version `2.22.1`.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
T1082 System Information Discovery Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
Why these techniques?

The vulnerability enables low-privileged Admin UI users (e.g., viewer role) to retrieve filtered configuration data via the API, disclosing backend infrastructure details such as server addresses, ports (System Network Configuration Discovery - T1016), and database usernames (System Information Discovery - T1082).

Affected Assets

ethyca
fides
≤ 2.22.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-863 CWE-200

Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.

addresses: CWE-863 CWE-200

Ensures authorization decisions for external system use are correctly implemented and enforced.

addresses: CWE-863 CWE-200

It assists users in evaluating and applying correct authorization decisions when sharing information with external partners.

addresses: CWE-200 CWE-863

Session auditing enables detection of unauthorized exposure or access to sensitive information during user activities.

addresses: CWE-863 CWE-200

Drives review and correction of flawed authorization logic applied to organizational data.

addresses: CWE-200 CWE-863

Annual reviews and proposal scrutiny detect and block matching programs that would expose sensitive data to unauthorized recipients or systems.

addresses: CWE-863 CWE-200

Restricts processing strictly to documented authorized uses, mitigating incorrect authorization decisions for sensitive data.

addresses: CWE-863 CWE-200

Addresses incorrect authorization by requiring independent verification of results and an opportunity to contest before any adverse action is taken.

References