CVE-2023-51451

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator's API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.

• CWE-918
• CWE-918

• https://github.com/getsentry/self-hosted/releases/tag/23.12.1Release Notes
• https://github.com/getsentry/symbolicator/pull/1343Patch
• https://github.com/getsentry/symbolicator/releases/tag/23.12.1Release Notes
• https://github.com/getsentry/symbolicator/security/advisories/GHSA-ghg9-7m82-h96rMitigation, Patch, Vendor Advisory
• https://github.com/getsentry/self-hosted/releases/tag/23.12.1Release Notes
• https://github.com/getsentry/symbolicator/pull/1343Patch
• https://github.com/getsentry/symbolicator/releases/tag/23.12.1Release Notes
• https://github.com/getsentry/symbolicator/security/advisories/GHSA-ghg9-7m82-h96rMitigation, Patch, Vendor Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51446GLPI is a Free Asset and IT Management Software package. Whe…8.1
• CVE-2023-51447Decidim is a participatory democracy framework. Starting in …5.4
• CVE-2023-51448Cacti provides an operational monitoring and fault managemen…8.8
• CVE-2023-51449Gradio is an open-source Python package that allows you to q…7.5
• CVE-2023-5145** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been fou…8.8
• CVE-2023-51450baserCMS is a website development framework. Prior to versio…8.1
• CVE-2023-51452A Improper Input Validation issue affecting the v2_sdk_servi…3
• CVE-2023-51453A Improper Input Validation issue affecting the v2_sdk_servi…3
• CVE-2023-51454A Out-of-bounds Write issue affecting the v2_sdk_service run…6.8
• CVE-2023-51455A Improper Validation of Array Index issue affecting the v2_…6.8
• CVE-2023-51456A Improper Input Validation issue affecting the v2_sdk_servi…6.8
• CVE-2023-51457Adobe Experience Manager versions 6.5.18 and earlier are aff…5.4