CVE-2023-49094

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

• CWE-918

• https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865aPatch, Vendor Advisory
• https://github.com/getsentry/symbolicator/pull/1332Vendor Advisory
• https://github.com/getsentry/symbolicator/releases/tag/23.11.2Release Notes, Vendor Advisory
• https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6Mitigation, Vendor Advisory
• https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865aPatch, Vendor Advisory
• https://github.com/getsentry/symbolicator/pull/1332Vendor Advisory
• https://github.com/getsentry/symbolicator/releases/tag/23.11.2Release Notes, Vendor Advisory
• https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6Mitigation, Vendor Advisory

Published

Nov 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49089Umbraco is an ASP.NET content management system (CMS). Start…6.5
• CVE-2023-4909Inappropriate implementation in Interstitials in Google Chro…4.3
• CVE-2023-49090CarrierWave is a solution for file uploads for Rails, Sinatr…6.1
• CVE-2023-49091Cosmos provides users the ability self-host a home server by…9.8
• CVE-2023-49092RustCrypto/RSA is a portable RSA implementation in pure Rust…5.9
• CVE-2023-49093HtmlUnit is a GUI-less browser for Java programs. HtmlUnit i…8.8
• CVE-2023-49095nexkey is a microblogging platform. Insufficient validation …7.5
• CVE-2023-49096Jellyfin is a Free Software Media System for managing and st…8.8
• CVE-2023-49097ZITADEL is an identity infrastructure system. ZITADEL uses t…8.8
• CVE-2023-49098Discourse-reactions is a plugin that allows user to add thei…3.5
• CVE-2023-49099Discourse is a platform for community discussion. Under very…4.3
• CVE-2023-4910A flaw was found In 3Scale Admin Portal. If a user logs out …5.5