CVE-2024-31223 - Vulnerability Details - OpenCVE

Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00271.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Ethyca	Fides

Configuration 1 [-]

cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097
https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg

History

Thu, 04 Sep 2025 14:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:ethyca:fides::::::::

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-07-03T17:34:48.508Z

Updated: 2024-08-02T01:46:04.901Z

Reserved: 2024-03-29T14:16:31.902Z

Link: CVE-2024-31223

Vulnrichment

Updated: 2024-07-22T16:42:40.407Z

NVD

Status : Analyzed

Published: 2024-07-03T18:15:05.097

Modified: 2025-09-04T14:07:17.867

Link: CVE-2024-31223

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31223", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-29T14:16:31.902Z", "datePublished": "2024-07-03T17:34:48.508Z", "dateUpdated": "2024-08-02T01:46:04.901Z"}, "containers": {"cna": {"title": "Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "lang": "en", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg"}, {"name": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097", "tags": ["x_refsource_MISC"], "url": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097"}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"version": ">= 2.19.0, < 2.39.2rc0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-03T17:34:48.508Z"}, "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available."}], "source": {"advisory": "GHSA-53q7-4874-24qg", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "ethyca", "product": "fides", "cpes": ["cpe:2.3:a:ethyca:fides:2.19.0:-:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.19.0", "status": "affected", "lessThan": "2.39.2rc0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-22T18:20:08.631813Z", "id": "CVE-2024-31223", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T18:20:30.888Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.901Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg"}, {"name": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31223", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-22T18:20:08.631813Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ethyca:fides:2.19.0:-:*:*:*:*:*:*"], "vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": "2.19.0", "lessThan": "2.39.2rc0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T16:42:40.407Z"}}], "cna": {"title": "Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL", "source": {"advisory": "GHSA-53q7-4874-24qg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": ">= 2.19.0, < 2.39.2rc0"}]}], "references": [{"url": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg", "name": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097", "name": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-07-03T17:34:48.508Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31223", "state": "PUBLISHED", "dateUpdated": "2024-07-22T18:20:30.888Z", "dateReserved": "2024-03-29T14:16:31.902Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-07-03T17:34:48.508Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ethyca:fides:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6BE90C1-F84C-4880-B0CF-DBF06116161C", "versionEndExcluding": "2.39.2", "versionStartIncluding": "2.19.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerability present starting in version 2.19.0 and prior to version 2.39.2rc0 allows an unauthenticated attacker to make a HTTP GET request from the Privacy Center that discloses the value of this server-side URL. This could result in disclosure of server-side configuration giving an attacker information on server-side ports, private IP addresses, and/or private domain names. The vulnerability has been patched in Fides version 2.39.2rc0. No known workarounds are available."}, {"lang": "es", "value": "Fides es una plataforma de ingenier\u00eda de privacidad de c\u00f3digo abierto y `SERVER_SIDE_FIDES_API_URL` es una variable de entorno de configuraci\u00f3n del lado del servidor utilizada por el Centro de Privacidad de Fides para comunicarse con el servidor web de Fides. El valor de esta variable es una URL que normalmente incluye una direcci\u00f3n IP privada, un nombre de dominio privado y/o un puerto. Una vulnerabilidad presente a partir de la versi\u00f3n 2.19.0 y antes de la versi\u00f3n 2.39.2rc0 permite que un atacante no autenticado realice una solicitud HTTP GET desde el Centro de privacidad que revela el valor de esta URL del lado del servidor. Esto podr\u00eda dar lugar a la divulgaci\u00f3n de la configuraci\u00f3n del lado del servidor, proporcionando al atacante informaci\u00f3n sobre los puertos del lado del servidor, direcciones IP privadas y/o nombres de dominio privados. La vulnerabilidad ha sido parcheada en la versi\u00f3n 2.39.2rc0 de Fides. No hay workarounds disponibles."}], "id": "CVE-2024-31223", "lastModified": "2025-09-04T14:07:17.867", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-07-03T18:15:05.097", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory", "Exploit"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/ethyca/fides/commit/0555080541f18a5aacff452c590ac9a1b56d7097"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "Exploit"], "url": "https://github.com/ethyca/fides/security/advisories/GHSA-53q7-4874-24qg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "security-advisories@github.com", "type": "Secondary"}]}