CVE-2025-57816— Fides 安全漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2025-57816の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Fides Webserver API Rate Limiting Vulnerability in Proxied Environments
ソース: NVD (National Vulnerability Database)
脆弱性説明
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rather than in a shared store. This allows attackers to bypass intended rate limits and potentially cause denial of service. This vulnerability only affects deployments relying on Fides's built-in rate limiting for protection. Deployments using external rate limiting solutions (WAFs, API gateways, etc.) are not affected. Version 2.69.1 fixes the issue. There are no application-level workarounds. However, rate limiting may instead be implemented externally at the infrastructure level using a WAF, API Gateway, or similar technology.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
交互频率的控制不恰当
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Fides 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Fides是Ethyca开源的一个开源隐私工程平台，用于管理运行时环境中数据隐私请求的实现以及代码中隐私法规的执行。 Fides 2.69.1之前版本存在安全漏洞，该漏洞源于IP速率限制在CDN或代理环境下失效，可能导致拒绝服务攻击。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2025-57816の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2025-57816のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · ethyca · 2025-09-08 · 4 CVEs total
| CVE-2025-57815 | Fides Lacks Brute-Force Protections on Authentication Endpoints | |
| CVE-2025-57817 | Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation | |
| CVE-2025-57766 | Fides's Admin UI User Password Change Does Not Invalidate Current Session |
IV. 関連脆弱性
同じ製品: fides
- CVE-2025-57817
Fides Webserver API is Vulnerable to OAuth Client Privilege - CVE-2025-57766
Fides's Admin UI User Password Change Does Not Invalidate Cu - CVE-2025-57815
Fides Lacks Brute-Force Protections on Authentication Endpoi - CVE-2024-52008
Password Policy Bypass Vulnerability in Fides Webserver - CVE-2024-45053
Remote Code Execution Vulnerability via SSTI in Fides Webser
同じベンダー: ethyca
- CVE-2025-57817
Fides Webserver API is Vulnerable to OAuth Client Privilege - CVE-2025-57766
Fides's Admin UI User Password Change Does Not Invalidate Cu - CVE-2025-57815
Fides Lacks Brute-Force Protections on Authentication Endpoi - CVE-2024-52008
Password Policy Bypass Vulnerability in Fides Webserver - CVE-2024-45053
Remote Code Execution Vulnerability via SSTI in Fides Webser
同じ弱点: CWE-799
- CVE-2026-7402
Improper Rate Limiting in MeWare Software's PDKS - CVE-2026-41346
OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Impro - CVE-2026-41343
OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Ha - CVE-2026-41333
OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass v - CVE-2025-55268
HCL Aftermarket DPC is affected by Spamming Vulnerability
V. CVE-2025-57816へのコメント
まだコメントはありません