CVE-2024-45052 Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability
Unauthenticated attackers can enumerate valid usernames via timing analysis in Fides Webserver, facilitating subsequent credential attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45052?
CVE-2024-45052 is a medium-severity vulnerability in ethyca fides, published on 4 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The discrepancy in response times between valid and invalid usernames can be leveraged to enumerate users on the system. This vulnerability enables a timing-based username enumeration attack. An attacker can systematically guess and verify which usernames are valid by measuring the server's response time to authentication requests. This information can be used to conduct further attacks on authentication such as password brute-forcing and credential stuffing. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no workarounds.
Which versions are affected by CVE-2024-45052?
3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ethyca-fides PyPI | All versions | 2.44.0 |
ethyca-fides PyPI | All versions | 2.44.0 |
ethyca-fides PyPI | All versions | 2.44.0 |
Products include Ethyca Fides.
How do I fix CVE-2024-45052?
Upgrade ethyca-fides to 2.44.0 or later.
Is CVE-2024-45052 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45052 exists.
Other vulnerabilities in ethyca fides
- CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload
Sources
Also known as GHSA-2h46-8gf5-fmxv, PYSEC-2026-1331.