PT-2024-29485 · Sentry · Sentry

Stsewd · Published 2024-07-23 · Updated 2024-07-24 · CVE-2024-41656

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sentry versions 10.0.0 through 24.7.0

Description The issue allows an unsanitized payload sent by an Integration platform integration to store arbitrary HTML tags on the Sentry side, which could be rendered on the Issues page. This creates a Stored Cross-Site Scripting (XSS) vulnerability, potentially leading to the execution of arbitrary scripts in the context of a user’s browser. Self-hosted Sentry users may be impacted if untrustworthy Integration platform integrations send external issues to their Sentry instance.

Recommendations For self-hosted users, upgrade Sentry to the latest version. If upgrading is not possible, enable CSP on the self-hosted installation with CSP REPORT ONLY = False (enforcing mode) to mitigate the risk of cross-site scripting. For Sentry SaaS customers, no action is needed as the issue has been patched.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-41656

GHSA-FM88-HC3V-3WWW

Affected Products

Sentry

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41656.json · Exploit
• https://github.com/getsentry/sentry/security/advisories/GHSA-fm88-hc3v-3www · Vendor Advisory
• https://github.com/getsentry/sentry/pull/74648 · Patch
• https://github.com/getsentry/sentry/commit/5c679521f1539eabfb81287bfc30f34dbecd373e · Patch
• https://osv.dev/vulnerability/GHSA-fm88-hc3v-3www · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41656 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41656 · Vendor Advisory
• https://github.com/getsentry/sentry · Note
• https://github.com/getsentry/self-hosted/releases/tag/24.7.1 · Note
• https://t.me/cvedetector/1529 · Telegram Post