{"cve":"CVE-2023-46124","nvd":{"published":"2023-10-25T18:17:36.400","modified":"2026-06-17T06:30:12.043","status":"Modified","description":"Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-918"],"references":["https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee","https://github.com/ethyca/fides/releases/tag/2.22.1","https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4","https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee","https://github.com/ethyca/fides/releases/tag/2.22.1"],"products":["ethyca:fides"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-46124","score":0.00839,"percentile":0.57838,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-jq3w-9mgf-43m4","url":"https://osv.dev/vulnerability/GHSA-jq3w-9mgf-43m4","summary":"Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload","modified":"2026-09-10T03:49:58.814711936Z","packages":[{"ecosystem":"PyPI","name":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","ranges":["<2.22.1"],"fixed":["2.22.1"]}]},{"id":"PYSEC-2026-1344","url":"https://osv.dev/vulnerability/PYSEC-2026-1344","summary":"Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload","modified":"2026-07-07T17:46:40.592929601Z","packages":[{"ecosystem":"PyPI","name":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","ranges":["<2.22.1"],"fixed":["2.22.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}