{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-47114", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-30T19:57:51.674Z", "datePublished": "2023-11-08T21:50:45.465Z", "dateUpdated": "2023-11-08T21:50:45.465Z"}, "containers": {"cna": {"title": "Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38"}, {"name": "https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1"}, {"name": "https://github.com/ethyca/fides/releases/tag/2.23.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/releases/tag/2.23.3"}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"version": ">= 2.15.1, < 2.23.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-11-08T21:50:45.465Z"}, "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. This vulnerability has been patched in version 2.23.3."}], "source": {"advisory": "GHSA-3vpf-mcj7-5h38", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*", "matchCriteriaId": "64694F6B-53E4-40E4-89FD-6BE525A038D7", "versionEndExcluding": "2.23.3", "versionStartIncluding": "2.15.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being bundled together as a data subject access request package for the data subject to download. Supported data formats for the package include json and csv, but the most commonly used format is a series of HTML files compressed in a ZIP file. Once downloaded and unzipped, the data subject user can browse the HTML files on their local machine. It was identified that there was no validation of input coming from e.g. the connected systems and data stores which is later reflected in the downloaded data. This can result in an HTML injection that can be abused e.g. for phishing attacks or malicious JavaScript code execution, but only in the context of the data subject's browser accessing a HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system / data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. This vulnerability has been patched in version 2.23.3."}, {"lang": "es", "value": "Fides es una plataforma de ingenier\u00eda de privacidad de c\u00f3digo abierto para gestionar el cumplimiento de las solicitudes de privacidad de datos en su entorno de ejecuci\u00f3n y la aplicaci\u00f3n de las regulaciones de privacidad en su c\u00f3digo. La aplicaci\u00f3n web de Fides permite a los usuarios interesados solicitar el acceso a sus datos personales. Si la solicitud es aprobada por el usuario del controlador de datos que opera la aplicaci\u00f3n web de Fides, los datos personales del interesado se pueden recuperar de los sistemas y almacenes de datos conectados antes de agruparlos como un paquete de solicitud de acceso del interesado para que el interesado los descargue. Los formatos de datos admitidos por el paquete incluyen json y csv, pero el formato m\u00e1s utilizado es una serie de archivos HTML comprimidos en un archivo ZIP. Una vez descargados y descomprimidos, el usuario interesado puede explorar los archivos HTML en su m\u00e1quina local. Se identific\u00f3 que no hubo validaci\u00f3n de las entradas provenientes, por ejemplo, de los sistemas conectados y los almacenes de datos, lo que luego se refleja en los datos descargados. Esto puede dar lugar a una inyecci\u00f3n de HTML de la que se puede abusar, por ejemplo, para ataques de phishing o ejecuci\u00f3n de c\u00f3digo JavaScript malicioso, pero s\u00f3lo en el contexto del navegador del interesado que accede a una p\u00e1gina HTML utilizando el protocolo `file://`. La explotaci\u00f3n se limita a usuarios no autorizados de la interfaz de usuario de administraci\u00f3n, a usuarios maliciosos del sistema conectado/almacenamiento de datos y al usuario interesado si se le enga\u00f1a mediante ingenier\u00eda social para que env\u00ede datos maliciosos. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 2.23.3."}], "id": "CVE-2023-47114", "lastModified": "2023-11-16T17:33:17.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-11-08T22:15:11.023", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/ethyca/fides/releases/tag/2.23.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}