CVE-2023-37480
CVE-2023-37480 is a low-severity vulnerability in Ethyca Fides with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.
Key facts
- Severity: Low (CVSS 3.x base score 2.7)
- EPSS exploit prediction: 1% (43rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-400
- Affected product: Ethyca Fides
- Published:
- Last modified:
Description
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.
Frequently asked questions
- What is CVE-2023-37480?
- Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.
- How severe is CVE-2023-37480?
- CVE-2023-37480 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2023-37480 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-37480?
- CVE-2023-37480 affects Ethyca Fides. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-37480?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-37480 published?
- CVE-2023-37480 was published on 2023-07-18 and last updated on 2026-06-17.
References
- https://github.com/ethyca/fides/commit/5aea738463960d81821c11ae7ade1d627a46bf32
- https://github.com/ethyca/fides/security/advisories/GHSA-g95c-2jgm-hqc6
Affected products (1)
- cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*
More vulnerabilities in Ethyca Fides
- CVE-2024-45053 — Critical (CVSS 9.1): Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email…
- CVE-2024-52008 — High (CVSS 8.8): Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side…
- CVE-2023-41319 — High (CVSS 8.8): Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime…
- CVE-2023-48224 — High (CVSS 8.2): Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime…
- CVE-2023-46124 — High (CVSS 8.2): Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime…
- CVE-2025-57816 — High (CVSS 7.5): Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in…
All CVEs affecting Ethyca Fides →
Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities
- CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
- CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
- CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
- CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
- CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
- CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…
Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →