CVE-2024-52008

🗓️ 26 Nov 2024 18:52:40Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 2800 Views🌐 WEB

Fides Webserver Password Policy Bypass Vulnerability

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-52008	26 Nov 202418:55	–	circl
CNNVD	Fides 安全漏洞	26 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-52008 Password Policy Bypass Vulnerability in Fides Webserver	26 Nov 202418:52	–	cvelist
EUVD	EUVD-2024-3385	3 Oct 202520:07	–	euvd
Github Security Blog	Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API	26 Nov 202416:36	–	github
NVD	CVE-2024-52008	26 Nov 202419:15	–	nvd
OSV	CVE-2024-52008 Password Policy Bypass Vulnerability in Fides Webserver	26 Nov 202418:52	–	osv
OSV	GHSA-V7VM-RHMG-8J2R Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API	26 Nov 202416:36	–	osv
OSV	PYSEC-2026-1349 Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API	7 Jul 202614:34	–	osv
Positive Technologies	PT-2024-35092	26 Nov 202400:00	–	ptsecurity

NVD

Vulners

Node

ethyca fidesRange<2.50.0

[
  {
    "vendor": "ethyca",
    "product": "fides",
    "versions": [
      {
        "version": "< 2.50.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ethyca/fides/security/advisories/GHSA-v7vm-rhmg-8j2r

Parameter	Position	Path	Description	CWE
password	request body	/api/v1/user/accept-invite	API endpoint allows setting an extremely weak password during initial account setup due to missing server-side password policy enforcement (client-side validation only).	CWE-602

17 Jun 2026 08:06Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.8

CVSS 42

EPSS0.00536

SSVC

CWE-602