CVE-2023-36829
Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation.
Does this matter?
Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.
Description
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- EPSS
- 0.67% probability · 50th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863, CWE-942, CWE-697
- Affected
- functional/sentry
- Source
- security-advisories@github.com
References
- https://github.com/getsentry/self-hosted/releases/tag/23.6.2Release Notes
- https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8bPatch
- https://github.com/getsentry/sentry/pull/52276Patch
- https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6Patch
- https://github.com/getsentry/self-hosted/releases/tag/23.6.2Release Notes
- https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8bPatch
- https://github.com/getsentry/sentry/pull/52276Patch
- https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.