Information Disclosure

2023-10-2507:43:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

information disclosure

ethyca-fides

roles.py

config_read

admin ui

sensitive config

api

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

31.8%

JSON

ethyca-fides is vulnerable to Information Disclosure. The vulnerability is due roles.py as it grants the CONFIG_READ scope to roles other than the owner, specifically the VIEWER and VIEWER_AND_APPROVER roles. This allows Admin UI users with roles lower than the owner role to retrieve sensitive config information using the API.