CVE-2024-32474

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Improper Output Neutralization for Logs pada sentry. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.

Rincian

Terbit di NVD

18 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-117: Improper Output Neutralization for Logs
CWE-312: Cleartext Storage of Sensitive Information

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9 mitigasi · advisory vendor
• https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f patch
• https://github.com/getsentry/sentry/pull/66393 issue tracking
• https://github.com/getsentry/sentry/pull/69148 issue tracking