Vulnerability in Getsentry Sentry
CVE-2024-32474
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (36.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 36.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Getsentry Sentry — versions >= 24.3.0, < 24.4.1
- Sentry
Weakness classification (CWE)
References
- github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9 (Mitigation, Vendor Advisory)
- github.com/getsentry/sentry/pull/66393 (Issue Tracking)
- github.com/getsentry/sentry/pull/69148 (Issue Tracking)
- github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f (Patch)
Frequently asked questions
- What is CVE-2024-32474?
- CVE-2024-32474 is a high-severity vulnerability in Getsentry Sentry, classified under Improper Output Neutralization for Logs. CVSS score: 7.3/10. Published 2024-04-18.
- How severe is CVE-2024-32474?
- High severity. CVSS v3 base score is 7.3 out of 10.