CVE-2023-39349

CVSS V2 None CVSS V3 None
Description
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
Overview
  • CVE ID
  • CVE-2023-39349
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-08-07T18:27:12.396Z
  • Last Modified Date
  • 2023-08-07T18:27:12.396Z
Weakness Enumerations
CWE URL
CWE-284 http://cwe.mitre.org/data/definitions/284.html
CWE-287 http://cwe.mitre.org/data/definitions/287.html
References
Reference URL Reference Tags
https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62c x_refsource_CONFIRM
https://github.com/getsentry/sentry/pull/53850 x_refsource_MISC
https://github.com/getsentry/sentry/commit/fad12c1150d1135edf9666ea72ca11bc110c1083 x_refsource_MISC
https://github.com/getsentry/self-hosted/releases/tag/23.7.2 x_refsource_MISC
https://github.com/getsentry/sentry/releases/tag/23.7.2 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-39349
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39349
History
Created Old Value New Value Data Type Notes
2024-06-25 18:46:29 Added to TrackCVE