CVE-2024-32474

CVSS V2 None CVSS V3 None
Description
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
Overview
  • CVE ID
  • CVE-2024-32474
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-04-18T19:50:44.541Z
  • Last Modified Date
  • 2024-06-04T17:51:26.370Z
Weakness Enumerations
CWE URL
CWE-312 http://cwe.mitre.org/data/definitions/312.html
CWE-117 http://cwe.mitre.org/data/definitions/117.html
References
Reference URL Reference Tags
https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9 x_refsource_CONFIRM
https://github.com/getsentry/sentry/pull/66393 x_refsource_MISC
https://github.com/getsentry/sentry/pull/69148 x_refsource_MISC
https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-32474
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32474
History
Created Old Value New Value Data Type Notes
2024-06-26 08:52:57 Added to TrackCVE