CVE-2023-39349
Last modified
CVE-2023-39349 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. EPSS estimates a 0.85% chance of exploitation in the next 30 days.
Description
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on `sentry.io`. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of `sentry` and `self-hosted`. There are no known workarounds.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sentry | Sentry | >= 22.1.0, < 23.7.2 |
References
- https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62cExploit, Patch, Third Party Advisory
- https://github.com/getsentry/sentry/security/advisories/GHSA-9jcq-jf57-c62cExploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-39349?
How severe is CVE-2023-39349?
How do I fix CVE-2023-39349?
Are you affected by CVE-2023-39349?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST