CVE-2024-45052

Advisory

In ethyca-fides affected versions, a timing-based username enumeration vulnerability exists in the Fides Webserver authentication process. This security flaw enables an unauthenticated attacker to discern the existence of valid usernames by analyzing the server's response times to login requests. The discernible difference in response times between valid and invalid usernames can be exploited to systematically enumerate users on the system, potentially compromising user privacy and serving as a stepping stone for further attacks.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/ethyca/fides/security/advisories/GHSA-2h46-8gf5-fmxv
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45052