CVE-2024-31223

Advisory

Fides affected versions are vulnerable to a security issue involving the SERVER_SIDE_FIDES_API_URL configuration environment variable used by the Fides Privacy Center. This variable typically contains a URL with a private IP address, private domain name, and/or port. An unauthenticated attacker could exploit this vulnerability to make an HTTP GET request from the Privacy Center, disclosing the value of this server-side URL. This disclosure could provide the attacker with information on server-side ports, private IP addresses, and/or private domain names.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
• https://github.com/ethyca/fides/commit/cd510216b281de5443ec1c126add95cc5be0970a
• https://github.com/advisories/GHSA-53q7-4874-24qg
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31223