CVE-2024-32474
Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`.
Does this matter?
Lower severity and a low EPSS score (0.43%). Track it; it rarely justifies an emergency change on its own.
Description
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.43% probability · 36th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-117, CWE-312
- Affected
- sentry/sentry
- Source
- security-advisories@github.com
References
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512fPatch
- https://github.com/getsentry/sentry/pull/66393Issue Tracking
- https://github.com/getsentry/sentry/pull/69148Issue Tracking
- https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9Mitigation, Vendor Advisory
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512fPatch
- https://github.com/getsentry/sentry/pull/66393Issue Tracking
- https://github.com/getsentry/sentry/pull/69148Issue Tracking
- https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.