3.9

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-46126

GHSA ID

GHSA-fgjj-5jmr-gh83

EPSS Score

0.35325%

CWE

CWE-79

Published

10/24/2023

Updated

11/9/2023

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-46126

CVE-2023-46126: Fides JavaScript Injection Vulnerability in Privacy Center URL

Impact

The Fides web application allows users to edit consent and privacy notices such as cookie banners. These privacy notices can then be served by other integrated websites, for example in cookie consent banners. One of the editable fields is a privacy policy URL and this input was found to not be validated.

The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website.

Exploitation is limited to Admin UI users with the contributor role or higher.

Patches

The vulnerability has been patched in Fides version 2.22.1. Users are advised to upgrade to this version or later to secure their systems against this threat.

Workarounds

There are no workarounds.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-46126

CVE-2023-46126:

3.9

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-46126

GHSA ID

GHSA-fgjj-5jmr-gh83

EPSS Score

0.35325%

CWE

CWE-79

Published

10/24/2023

Updated

11/9/2023

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ethyca-fides	pip	< 2.22.1	2.22.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from lack of URL validation in the privacy_policy_url field. The patch replaced the basic string type with Pydantic's HttpUrl type which enforces proper URL validation. The commit diff shows:

Original vulnerable code used 'Optional[str]' without validation
Patched code uses 'Optional[HttpUrl]' with Pydantic's URL validation
Test cases added to reject invalid URLs like 'javascript:alert()' The schema field's lack of validation directly enabled XSS payload injection when the URL was rendered in integrated websites.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-46126: Fides JavaScript Injection Vulnerability in Privacy Center URL

Impact

Patches

Workarounds

CVE-2023-46126:

3.9

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

3.9

3.9

CVE-2023-46126: Fides JavaScript Injection Vulnerability in Privacy Center URL

Impact

Patches

Workarounds

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI