CVE-2024-45605

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/getsentry/self-hosted	Product
https://github.com/getsentry/sentry/pull/77093	Issue Tracking Patch
https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-09-17 20:15

Updated : 2024-09-26 19:14

NVD link : CVE-2024-45605

Mitre link : CVE-2024-45605

CVE.ORG link : CVE-2024-45605

JSON object : View

Products Affected

sentry

sentry

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2024-45605", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-09-17T20:15:05.120", "references": [{"url": "https://github.com/getsentry/self-hosted", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getsentry/sentry/pull/77093", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Sentry es una plataforma de monitoreo de rendimiento y seguimiento de errores que prioriza a los desarrolladores. Un usuario autenticado elimina las notificaciones de alerta de emisi\u00f3n de usuario para usuarios arbitrarios a partir de una ID de alerta conocida. Se emiti\u00f3 un parche para garantizar que las verificaciones de autorizaci\u00f3n tengan el alcance adecuado en las solicitudes de eliminaci\u00f3n de notificaciones de alerta de usuario. Los usuarios de Sentry SaaS no necesitan realizar ninguna acci\u00f3n. Los usuarios de Sentry alojado en servidores propios deben actualizar a la versi\u00f3n 24.9.0 o superior. No existen workarounds para esta vulnerabilidad."}], "lastModified": "2024-09-26T19:14:00.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E6FD59C-D86A-4163-9245-EC4000DC98FC", "versionEndExcluding": "24.9.0", "versionStartIncluding": "23.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}