Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fides's Admin UI User Password Change Does Not Invalidate Current Session
Vulnerability Description
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.
CVSS Information
N/A
Vulnerability Type
不充分的会话过期机制
Vulnerability Title
Fides 代码问题漏洞
Vulnerability Description
Fides是Ethyca开源的一个开源隐私工程平台，用于管理运行时环境中数据隐私请求的实现以及代码中隐私法规的执行。 Fides 2.69.1之前版本存在代码问题漏洞，该漏洞源于密码更改后未使会话失效，可能导致权限维持。
CVSS Information
N/A
Vulnerability Type
N/A