Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by unauthorized parties. A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version **24.9.0** or higher. The rule mute feature was generally available as of 23.6.0 but users with early access may have had the feature as of 23.4.0. Affected users are advised to upgrade to version 24.9.0. There are no known workarounds for this vulnerability.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NSentry
APPSentry23.4.0 – 24.9.0 (bez)
Powiązane podatności
Przejęcie konta użytkownika przez podatność SAML SSO w Sentry
Sentry SAML SSO — przejęcie konta użytkownika (Auth Bypass)
Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression De...
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute ar...
Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to versi...