CVE-2022-23485

    Dashboard / Vulnerabilities / CVE-2022-23485

    CVE-2022-23485

    Published: 10 Dec 2022Last Modified: 12 Aug 2026

    Summary: Invite code reuse via cookie manipulation in sentry

    Details: Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23485.json, https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j, https://nvd.nist.gov/vuln/detail/CVE-2022-23485

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 37a7530206f8407f1127fc8e9bb2fdd99cdffb31
    Fixed -60999b0f47b3ffe7f2fbbd5e86d9bb9711e5a2c0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23485 | CVE-DB