Homepage

ethyca-fides@2.80.1rc0

Open-source ecosystem for data privacy as code.

  • latest version

    2.86.2

  • latest non vulnerable version

    2.86.2

  • first published

    3 years ago

  • latest version published

    2 months ago

  • licenses detected

  • View ethyca-fides package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the ethyca-fides package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Cross-site Scripting (XSS)

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the fides.js script's override mechanism for the banner description field when HTML-formatted descriptions are enabled. An attacker can execute arbitrary JavaScript in the context of the embedding site's origin by supplying a crafted value through a URL parameter, JavaScript global, or cookie, leading to persistent script execution across all subdomains until cookies are cleared. This is only exploitable if the HTML description feature is enabled (the FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION environment variable is set to true).

    How to fix Cross-site Scripting (XSS)?

    Upgrade ethyca-fides to version 2.84.5rc0 or higher.

    [2.33.0,2.84.5rc0)
    • M
    Improper Enforcement of Behavioral Workflow

    ethyca-fides is an Open-source ecosystem for data privacy as code.

    Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow in the privacy request approval process when both subject_identity_verification_required and privacy_request_duplicate_detection.enabled are set to true. An attacker can cause unauthorized deletion of a data subject's records by submitting duplicate privacy requests using the target's email address and never completing identity verification, leading an administrator to inadvertently approve the request without proper verification. This is only exploitable if both subject_identity_verification_required and privacy_request_duplicate_detection.enabled are enabled in the deployment.

    How to fix Improper Enforcement of Behavioral Workflow?

    Upgrade ethyca-fides to version 2.83.2rc3 or higher.

    [2.75.0,2.83.2rc3)
    Go back to all versions of this package