p PatchFirst

CVE-2023-36829

CVE-2023-36829 · Sentry CORS misconfiguration vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.

CVSS 6.8 · Medium · EPSS 0.7% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • sentry

    Versions
    • >= 23.6.0, < 23.6.2: Affected

    No fix published

  • sentry PyPI

    Versions
    • 23.6.0
    • 23.6.1
    Affected ranges
    • ECOSYSTEM: ≥ 23.6.0, < 23.6.2

    Update to 23.6.2

  • sentry PyPI

    Versions
    • 23.6.0
    • 23.6.1
    Affected ranges
    • GIT: < ee44c6be35e5e464bc40637580f39867898acd8b
    • ECOSYSTEM: ≥ 23.6.0, < 23.6.2

    Update to 23.6.2

Original sources

Check your server →