Robertkeyser

**Nome do software vulnerável e versões afetadas** Versões do Fides anteriores à 2.44.0 **Descrição** Existe uma vulnerabilidade de enumeração de nomes de usuário baseada em tempo na autenticação do servidor web Fides, permitindo que um invasor não autenticado determine a existência de nomes de usuário válidos ao analisar o tempo que o servidor leva para responder a solicitações de login. A discrepância nos tempos de resposta entre nomes de usuário válidos e inválidos pode ser aproveitada para enumerar usuários no sistema. Essas informações podem ser usadas para realizar ataques adicionais à autenticação, como força-bruta de senhas e preenchimento de credenciais. **Recomendações** Para resolver o problema, atualize para a versão 2.44.0 ou posterior do Fides. Não há soluções alternativas para esta vulnerabilidade. Como medida de mitigação temporária, considere restringir o acesso ao endpoint de autenticação até que um patch seja aplicado.

**Name of the Vulnerable Software and Affected Versions** Fides versions prior to 2.24.0 **Description** The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. If `subject identity verification required` is set to `True`, data subjects are sent a one-time code to their email address or phone number. However, the one-time code values were generated by the python `random` module, a cryptographically weak pseudo-random number generator. This allows an attacker to predict all future one-time code values during the lifetime of the backend python process, enabling them to submit verified data erasure requests or modify a user's privacy preferences. **Recommendations** For Fides versions prior to 2.24.0, upgrade to version 2.24.0 or later to secure your system against this threat. As a temporary workaround, consider setting `subject identity verification required` to `False` to prevent the use of one-time codes until a patch is applied. However, this may reduce the security of the privacy and consent request process.

**Name of the Vulnerable Software and Affected Versions** Fides versions prior to 2.23.3 **Description** The Fides web application is vulnerable to an HTML injection issue due to the lack of validation of input coming from connected systems and data stores. This can result in malicious JavaScript code execution or phishing attacks when a data subject user accesses an HTML page using the `file://` protocol. Exploitation is limited to rogue Admin UI users, malicious connected system or data store users, and the data subject user if tricked via social engineering into submitting malicious data themselves. **Recommendations** For versions prior to 2.23.3, upgrade to version 2.23.3 or later to secure the system against this threat. As a temporary workaround, consider configuring the storage destination to use `json` or `csv` instead of `html` as the package format to eliminate this vulnerability.