CVE-2024-45605

Katalog CVE

CVSS 4.3 · Medium EPSS 0,39%

Kerentanan Authorization Bypass Through User-Controlled Key pada sentry. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

17 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j advisory vendor
• https://github.com/getsentry/sentry/pull/77093 issue tracking · patch
• https://github.com/getsentry/self-hosted product