p PatchFirst

CVE-2023-39349

CVE-2023-39349 · Sentry vulnerable to privilege escalation via ApiTokensEndpoint

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.

CVSS 8.1 · Alta · EPSS 1,1% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • sentry

    Versiones
    • >= 22.1.0, < 23.7.2: Afectada

    Sin corrección publicada

  • sentry PyPI

    Versiones
    • 22.1.0
    • 22.10.0
    • 22.11.0
    • 22.12.0
    • 22.2.0
    • 22.3.0
    • 22.4.0
    • 22.5.0
    • 22.6.0
    • 22.7.0
    • 22.8.0
    • 22.9.0
    • 23.1.0
    • 23.1.1
    • 23.2.0
    • 23.3.0
    • 23.3.1
    • 23.4.0
    • 23.5.0
    • 23.5.1
    • 23.5.2
    • 23.6.0
    • 23.6.1
    • 23.6.2
    • 23.7.0
    • 23.7.1
    Intervalos de versiones afectados
    • ECOSYSTEM: ≥ 22.1.0, < 23.7.2

    Actualiza a 23.7.2

Fuentes originales

Comprueba tu servidor →