PT-2024-24600 · Sentry · Sentry

Lluuaapp · Published 2024-04-18 · Updated 2025-09-15 · CVE-2024-32474

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sentry versions prior to 24.4.1

Description Sentry is an error tracking and performance monitoring platform. When authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event : auth-index.validate superuser. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser.

Recommendations For Sentry versions prior to 24.4.1, upgrade to 24.4.1 or later. As a temporary workaround, consider configuring the logging level to exclude logs of the INFO level and only generate logs for levels at WARNING or higher.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-117

Related Identifiers

CVE-2024-32474

GHSA-6CJM-4PXW-7XP9

Affected Products

Sentry

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32474.json · Exploit
• https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9 · Vendor Advisory
• https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f · Patch
• https://osv.dev/vulnerability/CVE-2024-32474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32474 · Security Note
• https://osv.dev/vulnerability/GHSA-6cjm-4pxw-7xp9 · Vendor Advisory
• https://github.com/getsentry/sentry · Note
• https://github.com/getsentry/sentry/pull/69148 · Note
• https://github.com/getsentry/sentry/pull/66393 · Note
• https://t.me/cveNotify/135490 · Telegram Post
• https://t.me/cvenotify/77414 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1781089187963220388 · Twitter Post
• https://twitter.com/CVEnew/status/1781102369524404286 · Twitter Post
• https://t.me/cvenotify/77353 · Telegram Post