Privilege escalation in Getsentry Sentry
CVE-2022-23485
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (37.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Getsentry Sentry — versions >= 20.6.0, < 22.11.0
- Sentry
Weakness classification (CWE)
References
- github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2022-23485?
- CVE-2022-23485 is a medium-severity vulnerability in Getsentry Sentry, classified under Improper Privilege Management. CVSS score: 6.4/10. Published 2022-12-10.
- How severe is CVE-2022-23485?
- Medium severity. CVSS v3 base score is 6.4 out of 10.