Description (CNA)
Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ethyca / fides | affected >= 2.33.0, < 2.84.5 |
CWE
CWE-79
References
- https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2
- https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd
- https://github.com/ethyca/fides/releases/tag/2.84.5
ADP enrichment
No English description supplied.