CVE-2023-46729

Katalog CVE

CVSS 6.1 · Medium EPSS 0,63%

Kerentanan Server-Side Request Forgery (SSRF) pada sentry software development kit. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.

Rincian

Terbit di NVD

10 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9 advisory vendor
• https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be patch
• https://github.com/getsentry/sentry-javascript/pull/9415 patch