CVE-2023-47114

Advisory

Ethyca-fides 2.23.3 addresses the security vulnerability CVE-2023-47114. This vulnerability allowed for HTML injection that could lead to phishing attacks or malicious JavaScript execution when accessing HTML pages via the file:// protocol.
https://github.com/ethyca/fides/commit/74a095f490ea2f1db8bf18a1605ccbee8846373c.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Release Pull Request
https://github.com/ethyca/fides/pull/4398

What's Changed
* Fix button arrangment and spacing for TCF and non-TCF consent overlay banner and modal by allisonking and Kelsey-Ethyca in https://github.com/ethyca/fides/pull/4391
* Replaced h1 element with div to use exisitng fides styles in consent modal by SteveDMurphy in https://github.com/ethyca/fides/pull/4399
* Fix an HTML Injection vulnerability in DSR Packages by ThomasLaPiana

**Full Changelog**: https://github.com/ethyca/fides/compare/2.23.2...2.23.3

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47114
• https://github.com/ethyca/fides/security/advisories/GHSA-3vpf-mcj7-5h38
• https://github.com/ethyca/fides/commit/50360a0e24aac858459806bb140bb1c4b71e67a1
• https://github.com/ethyca/fides/releases/tag/2.23.3