Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-46125

CVE-2023-46125: Fides Information Disclosure Vulnerability in Config API Endpoint

6.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-46125
GHSA ID
GHSA-rjxg-rpg3-9r89
EPSS Score
0.40036%
CWE
CWE-200
Published
10/24/2023
Updated
11/11/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ethyca-fidespip< 2.22.12.22.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper role-based access control (RBAC) configuration rather than specific code functions. The root cause was the inclusion of the CONFIG_READ scope in the viewer and contributor role definitions (as class-level variables in RoleRegistryEnum), allowing lower-privileged users to access the sensitive config endpoint. The patch removed CONFIG_READ from these roles' scopes in src/fides/api/oauth/roles.py. While this configuration error created the vulnerability, there are no traditional 'functions' to list here - the exposure was caused by misconfigured authorization scopes in role definitions rather than flawed function logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** *i**s w**s*rv*r *PI *llows us*rs to r*tri*v* its *on*i*ur*tion usin* t** `**T *pi/v*/*on*i*` *n*point. T** *on*i*ur*tion **t* is *ilt*r** to suppr*ss most s*nsitiv* *on*i*ur*tion in*orm*tion ***or* it is r*turn** to t** us*r, *ut *v*n

Reasoning

T** vuln*r**ility st*ms *rom improp*r rol*-**s** ****ss *ontrol (R***) *on*i*ur*tion r*t**r t**n sp**i*i* *o** *un*tions. T** root **us* w*s t** in*lusion o* t** *ON*I*_R*** s*op* in t** vi*w*r *n* *ontri*utor rol* ***initions (*s *l*ss-l*v*l v*ri**l