CVE-2023-37481
CVE-2023-37481 is a low-severity vulnerability in Ethyca Fides with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.
Key facts
- Severity: Low (CVSS 3.x base score 2.7)
- EPSS exploit prediction: 1% (43rd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-400
- Affected product: Ethyca Fides
- Published:
- Last modified:
Description
Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.
Frequently asked questions
- What is CVE-2023-37481?
- Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.
- How severe is CVE-2023-37481?
- CVE-2023-37481 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2023-37481 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-37481?
- CVE-2023-37481 affects Ethyca Fides. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-37481?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2023-37481 published?
- CVE-2023-37481 was published on 2023-07-18 and last updated on 2026-06-17.
References
- https://github.com/ethyca/fides/commit/8beaace082b325e693dc7682029a3cb7e6c2b69d
- https://github.com/ethyca/fides/security/advisories/GHSA-3rw2-wfc8-wmj5
Affected products (1)
- cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*
More vulnerabilities in Ethyca Fides
- CVE-2024-45053 — Critical (CVSS 9.1): Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email…
- CVE-2024-52008 — High (CVSS 8.8): Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side…
- CVE-2023-41319 — High (CVSS 8.8): Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime…
- CVE-2023-48224 — High (CVSS 8.2): Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime…
- CVE-2023-46124 — High (CVSS 8.2): Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime…
- CVE-2025-57816 — High (CVSS 7.5): Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in…
All CVEs affecting Ethyca Fides →
Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities
- CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
- CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
- CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
- CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
- CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
- CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…
Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →