CVE-2023-36829
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Sentry versions 23.6.0 to 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header when the `Origin` request header ends with the `system.base-hostname` option. This issue only affects installations where this option is explicitly set.
Risk Assessment
Although the impact is limited due to default cross-site cookie blocking in modern browsers, this vulnerability could allow for other multi-step attacks.
Recommendation
It is recommended to upgrade to Sentry version 23.6.2, which includes a patch that addresses this vulnerability.
Original NVD description (English source)
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.