CVE-2023-36829

    Dashboard / Vulnerabilities / CVE-2023-36829

    CVE-2023-36829

    Published: 6 Jul 2023Last Modified: 12 Aug 2026

    Summary: Sentry CORS misconfiguration vulnerability

    Details: Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.

    References: https://github.com/getsentry/self-hosted/releases/tag/23.6.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36829.json, https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6, https://nvd.nist.gov/vuln/detail/CVE-2023-36829, https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b, https://github.com/getsentry/sentry/pull/52276

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- dbded584377d50a2545a98de5d0d53d204b369a0
    Fixed -5c5bf06fae3ac6b8c60b4770d4ac985ea670103f

    Affected versions

    8.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-36829 | CVE-DB