PYSEC-2023-115

    Dashboard / Vulnerabilities / PYSEC-2023-115

    PYSEC-2023-115

    Published: 6 Jul 2023Last Modified: 8 Nov 2023

    Summary:

    Details: Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.

    References: https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b, https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6, https://github.com/getsentry/sentry/pull/52276, https://github.com/getsentry/self-hosted/releases/tag/23.6.2

    Affected packages

    Package

    Name: sentry

    Purl: pkg:pypi/sentry

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ee44c6be35e5e464bc40637580f39867898acd8b

    Affected versions

    23.6.0
    23.6.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2023-115 | CVE-DB