CVE-2024-38537

Advisory

Fides affected versions use the polyfill.io domain to support legacy browsers like IE11 that do not support the fetch standard. This allows users of pre-2017 browsers to potentially download and execute malicious scripts from polyfill.io when compromised. Although no exploitation has been identified, the vulnerability has been patched. On June 27, 2024, Cloudflare and Namecheap intervened to prevent polyfill.io from resolving to the compromised service, rendering this vulnerability unexploitable. Prior to this intervention, the impacts on confidentiality, integrity, and availability were high. Clients can mitigate risk by using modern browsers that support the fetch standard.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ethyca/fides/commit/868c4d629760572192bd61db34f5a4458ed12005
• https://github.com/advisories/GHSA-cvw4-c69g-7v7m
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38537