PT-2024-31705 · Sentry · Sentry

Emanuelbeni · Published 2024-09-17 · Updated 2024-09-26 · CVE-2024-45606

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Sentry versions prior to 24.9.0

Description: Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a known rule ID, without needing to be a member of the organization or having permissions on the project. A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules, preventing authenticated users without necessary permissions from muting alerts. There have been no identified instances of alerts being muted by unauthorized parties.

Recommendations: For Self-Hosted Sentry users, upgrade to version 24.9.0 or higher to ensure authorization checks are properly scoped. Sentry SaaS users do not need to take any action. As a temporary workaround, consider restricting access to the alert rule mute feature until the patch is applied. There are no known workarounds for this issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-45606

GHSA-V345-W9F2-MPM5

Affected Products

Sentry

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45606.json · Exploit
• https://github.com/getsentry/sentry/security/advisories/GHSA-v345-w9f2-mpm5 · Vendor Advisory
• https://github.com/getsentry/sentry/pull/77016 · Patch
• https://osv.dev/vulnerability/CVE-2024-45606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45606 · Security Note
• https://osv.dev/vulnerability/GHSA-v345-w9f2-mpm5 · Vendor Advisory
• https://github.com/getsentry/sentry · Note
• https://github.com/getsentry/sentry/commit/e8e71708758e1f9f56ce815ace73fe60d9e608dc · Note
• https://github.com/getsentry/self-hosted · Note
• https://twitter.com/cracbot/status/1837733679646626030 · Twitter Post
• https://twitter.com/CVEnew/status/1836137285085204503 · Twitter Post
• https://t.me/cvedetector/5849 · Telegram Post
• https://t.me/cvenotify/96218 · Telegram Post