PT-2022-16019 · Sentry · Sentry

Mdtrop · Published 2022-12-10 · Updated 2022-12-13 · CVE-2022-23485

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sentry versions prior to 22.11.0

Description Sentry is an error tracking and performance monitoring platform. An attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result, an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to.

Recommendations For versions prior to 22.11.0, update to version 22.11.0 or later to resolve the issue. For self-hosted Sentry installs that cannot upgrade, disable the invite functionality by editing the sentry.conf.py file and setting SENTRY FEATURES["organizations:invite-members"] to False, then restart the Sentry web service.

Exploit

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2022-23485

GHSA-JV85-MQXJ-3F9J

PYSEC-2022-43011

Affected Products

Sentry

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23485.json · Exploit
• https://ubuntu.com/security/CVE-2022-23485 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23485 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23485 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23485 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23485 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43011 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv85-mqxj-3f9j · Vendor Advisory
• https://github.com/getsentry/sentry · Note
• https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j · Note
• https://github.com/getsentry/sentry/commit/565f971da955d57c754a47f5802fe9f9f7c66b39 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2022-43011.yaml · Note
• https://t.me/cibsecurity/54254 · Telegram Post