CVE-2023-37481

Fides Webserver Vulnerable to SVG Bomb File Uploads

Description

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.

Category

2.7
CVSS
Severity: Low
CVSS 3.1 •
EPSS 0.08%
Vendor Advisory github.com
Affected: ethyca fides
Published at:
Updated at:

References

Link Tags
https://github.com/ethyca/fides/security/advisories/GHSA-3rw2-wfc8-wmj5 vendor advisory
https://github.com/ethyca/fides/commit/8beaace082b325e693dc7682029a3cb7e6c2b69d patch

Frequently Asked Questions

What is the severity of CVE-2023-37481?
CVE-2023-37481 has been scored as a low severity vulnerability.
How to fix CVE-2023-37481?
To fix CVE-2023-37481, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-37481 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-37481 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-37481?
CVE-2023-37481 affects ethyca fides.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.