TI-2023-19089 Aliases CVE-2023-37481 GHSA-3rw2-wfc8-wmj5

Fides Webserver Vulnerable to SVG Bomb File Uploads

LOW 24CWE-400Published 2023-07-18 · Updated 2024-10-18

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`). This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role. The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There is no known workaround to remediate this vulnerability without upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00704 53rd percentileScored 2026-11-07

Fix Fixed fides (ethyca): 2.16.0ethyca-fides (PyPI): 2.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ethyca	fides	2.11.0 to before 2.16.0	2.16.0	Patch available	CNA
—	ethyca-fides (PyPI)	2.11.0 to before 2.16.0	2.16.0	Patch available	GHSA-3rw2-wfc8-wmj5

fides Vendorethyca Affected 2.11.0 to before 2.16.0 Fixed in 2.16.0 Patch available CNA
ethyca-fides (PyPI) Vendor— Affected 2.11.0 to before 2.16.0 Fixed in 2.16.0 Patch available GHSA-3rw2-wfc8-wmj5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ethyca:fides::::::::	2.11.0 to before 2.16.0	Vulnerable	ethyca

cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:* Versions 2.11.0 to before 2.16.0 Vulnerable ·ethyca

Remediation

Fix · CNA fides (ethyca) Fixed in 2.16.0
Fix · GHSA-3rw2-wfc8-wmj5 ethyca-fides (PyPI) Fixed in 2.16.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-37481
2026-10-03 Alias added: GHSA-3rw2-wfc8-wmj5

References

Patch 1

https://github.com/ethyca/fides/commit/8beaace082b325e693dc7682029a3cb7e6c2b69d

Advisory 2

Other 2

TI-2024-30165 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine CVSS 3.1CRITICAL 9.1
TI-2024-30164 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability CVSS 3.1MEDIUM 5.3
TI-2024-20599 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL CVSS 3.1MEDIUM 5.3
TI-2024-23262 Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides CVSS 3.1MEDIUM 6.5
TI-2023-26088 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides CVSS 3.1CRITICAL 9.1
TI-2025-35700 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVSS 4.0HIGH 8.6

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences