TI-2023-19088 Aliases CVE-2023-37480 GHSA-g95c-2jgm-hqc6

Fides Webserver Vulnerable to Zip Bomb File Uploads

LOW 24CWE-400Published 2023-07-18 · Updated 2024-10-18

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver. This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00685 52nd percentileScored 2026-11-07

Fix Fixed fides (ethyca): 2.16.0ethyca-fides (PyPI): 2.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ethyca	fides	2.11.0 to before 2.16.0	2.16.0	Patch available	CNA
—	ethyca-fides (PyPI)	2.11.0 to before 2.16.0	2.16.0	Patch available	GHSA-g95c-2jgm-hqc6

fides Vendorethyca Affected 2.11.0 to before 2.16.0 Fixed in 2.16.0 Patch available CNA
ethyca-fides (PyPI) Vendor— Affected 2.11.0 to before 2.16.0 Fixed in 2.16.0 Patch available GHSA-g95c-2jgm-hqc6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ethyca:fides::::::::	2.11.0 to before 2.16.0	Vulnerable	ethyca

cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:* Versions 2.11.0 to before 2.16.0 Vulnerable ·ethyca

Remediation

Fix · CNA fides (ethyca) Fixed in 2.16.0
Fix · GHSA-g95c-2jgm-hqc6 ethyca-fides (PyPI) Fixed in 2.16.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-37480
2026-10-03 Alias added: GHSA-g95c-2jgm-hqc6

References

Patch 1

https://github.com/ethyca/fides/commit/5aea738463960d81821c11ae7ade1d627a46bf32

Advisory 2

Other 2

TI-2024-30165 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine CVSS 3.1CRITICAL 9.1
TI-2024-30164 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability CVSS 3.1MEDIUM 5.3
TI-2024-20599 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL CVSS 3.1MEDIUM 5.3
TI-2024-23262 Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides CVSS 3.1MEDIUM 6.5
TI-2023-26088 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides CVSS 3.1CRITICAL 9.1
TI-2025-35700 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVSS 4.0HIGH 8.6

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences