GHSA-r25m-cr6v-p9hq

Source

https://github.com/advisories/GHSA-r25m-cr6v-p9hq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-r25m-cr6v-p9hq/GHSA-r25m-cr6v-p9hq.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r25m-cr6v-p9hq

Aliases

Published

2023-07-06T20:40:17Z

Modified

2026-08-24T00:35:29Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

ethyca-fides Webserver API Path Traversal vulnerability

Details

Impact

A path traversal (directory traversal) vulnerability affects fides versions lower than 2.15.1, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.

Patches

The vulnerability is patched in fides 2.15.1. Users should upgrade to this version.

Workarounds

If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's security best practice documentation, and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.

Additionally, any secrets supplied to the container using environment variables rather than a fides.toml configuration file are not affected by this vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-06T20:40:17Z",
    "nvd_published_at":  "2023-07-05T22:15:10Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / ethyca-fides

Package

Name: ethyca-fides; View open source insights on deps.dev
Purl: pkg:pypi/ethyca-fides

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.15.1

Affected versions

1.*

1.9.9

2.*

2.0.0

2.1.0

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.4.0

2.5.0

2.5.1

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.7.0

2.7.1

2.8.0

2.8.1

2.8.2

2.8.3

2.9.0

2.9.1

2.9.2

2.10.0

2.11.0

2.12.0

2.12.1

2.13.0

2.14.0

2.14.1

2.14.2

2.15.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-r25m-cr6v-p9hq/GHSA-r25m-cr6v-p9hq.json"