GitHub Advisoryadvisory · PyPI
GHSA-54m3-95j9-v89j Sentry improperly authorizes deletion of user issue alert notifications
HIGH
Official page ↗
- Aliases
- CVE-2024-45605
- Ecosystem
- PyPI
- Packages
- sentry
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-639
- Reviewed
- 2024-09-17
Affected packages
• PyPI sentry: >= 23.9.0, < 24.9.0 → fixed in 24.9.0
Description
Impact
An authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID.
Patches
A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications.
Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher.
References
• Prevent muting user alerts
Related
Alias · CVE (1)
- CVE-2024-45605 Sentry is a developer-first error tracking and performance monitoring platform. vulnerability
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j web
- https://nvd.nist.gov/vuln/detail/CVE-2024-45605 advisory
- https://github.com/getsentry/sentry/pull/77093 web
- https://github.com/getsentry/sentry/commit/590258255bcb3a5fa4c56f21297b6c99131cfb9d web
- https://github.com/getsentry/self-hosted web
- https://github.com/getsentry/sentry package