Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.
Metrics
Affected Vendors & Products
References
History
Wed, 06 Nov 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Sentry
Sentry sentry |
|
CPEs | cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:* | |
Vendors & Products |
Sentry
Sentry sentry |
|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2023-07-06T22:08:58.922Z
Updated: 2024-11-06T16:44:37.019Z
Reserved: 2023-06-27T15:43:18.388Z
Link: CVE-2023-36829
Vulnrichment
Updated: 2024-08-02T17:01:09.196Z
NVD
Status : Modified
Published: 2023-07-06T23:15:09.620
Modified: 2024-11-21T08:10:41.450
Link: CVE-2023-36829
Redhat
No data.