pysec - pysec-2023-130

pysec-2023-130

Vulnerability from pysec

Published

2023-07-25 19:15

Modified

2023-08-02 16:31

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sentry",
        "purl": "pkg:pypi/sentry"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e932b15435bf36239431eaa3790a6bcfa47046a9"
            }
          ],
          "repo": "https://github.com/getsentry/sentry",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "8.21.0"
            },
            {
              "fixed": "23.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0",
        "10.0.1",
        "20.10.1",
        "20.11.0",
        "20.11.1",
        "20.12.0",
        "20.12.1",
        "20.6.0",
        "20.7.0",
        "20.7.1",
        "20.7.2",
        "20.8.0",
        "21.1.0",
        "21.10.0",
        "21.11.0",
        "21.12.0",
        "21.2.0",
        "21.3.0",
        "21.3.1",
        "21.4.0",
        "21.4.1",
        "21.5.0",
        "21.5.1",
        "21.6.0",
        "21.6.1",
        "21.6.2",
        "21.6.3",
        "21.7.0",
        "21.8.0",
        "21.9.0",
        "22.1.0",
        "22.10.0",
        "22.11.0",
        "22.12.0",
        "22.2.0",
        "22.3.0",
        "22.4.0",
        "22.5.0",
        "22.6.0",
        "22.7.0",
        "22.8.0",
        "22.9.0",
        "23.1.0",
        "23.1.1",
        "23.2.0",
        "23.3.0",
        "23.3.1",
        "23.4.0",
        "23.5.0",
        "23.5.1",
        "8.21.0",
        "8.22.0",
        "9.0.0",
        "9.0.0rc1",
        "9.1.0",
        "9.1.1",
        "9.1.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-36826",
    "GHSA-m4hc-m2v6-hfw8"
  ],
  "details": "Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.",
  "id": "PYSEC-2023-130",
  "modified": "2023-08-02T16:31:39.850029+00:00",
  "published": "2023-07-25T19:15:00+00:00",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8"
    },
    {
      "type": "FIX",
      "url": "https://github.com/getsentry/sentry/pull/49680"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2023-36826

Vulnerability from cvelistv5

Published

2023-07-25 18:50

Modified

2024-10-03 19:25

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

Sentry vulnerable to improper authorization on debug and artifact file downloads

References

▼	URL	Tags
	https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8	x_refsource_CONFIRM
	https://github.com/getsentry/sentry/pull/49680	x_refsource_MISC
	https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9	x_refsource_MISC

Impacted products

▼	Vendor	Product
	getsentry	sentry

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.754Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8"
          },
          {
            "name": "https://github.com/getsentry/sentry/pull/49680",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/getsentry/sentry/pull/49680"
          },
          {
            "name": "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-03T19:25:05.837092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-03T19:25:30.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sentry",
          "vendor": "getsentry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 8.21.0, \u003c 23.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sentry is an error tracking and performance monitoring platform. Starting in version 8.21.0 and prior to version 23.5.2, an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project. A patch was issued in version 23.5.2 to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-25T18:50:42.350Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8"
        },
        {
          "name": "https://github.com/getsentry/sentry/pull/49680",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getsentry/sentry/pull/49680"
        },
        {
          "name": "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9"
        }
      ],
      "source": {
        "advisory": "GHSA-m4hc-m2v6-hfw8",
        "discovery": "UNKNOWN"
      },
      "title": "Sentry vulnerable to improper authorization on debug and artifact file downloads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-36826",
    "datePublished": "2023-07-25T18:50:42.350Z",
    "dateReserved": "2023-06-27T15:43:18.388Z",
    "dateUpdated": "2024-10-03T19:25:30.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-m4hc-m2v6-hfw8

Vulnerability from github

Published

2023-07-25 17:19

Modified

2024-10-26 22:53

Severity ?

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
8.3 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Summary

Improper authorization on debug and artifact file downloads

Details

Impact

An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project.

Patches

A patch was issued to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them.

Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.

References

Restrict file downloads to Project

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sentry"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.21.0"
            },
            {
              "fixed": "23.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-36826"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-25T17:19:48Z",
    "nvd_published_at": "2023-07-25T19:15:11Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAn authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project.\n\n### Patches\n\nA patch was issued to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them.\n\n**Sentry SaaS users do not need to take any action. [Self-Hosted Sentry](https://github.com/getsentry/self-hosted) users should upgrade to version 23.5.2 or higher.**\n\n### References\n\n- [Restrict file downloads to Project](https://github.com/getsentry/sentry/pull/49680)",
  "id": "GHSA-m4hc-m2v6-hfw8",
  "modified": "2024-10-26T22:53:43Z",
  "published": "2023-07-25T17:19:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry/security/advisories/GHSA-m4hc-m2v6-hfw8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36826"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry/pull/49680"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getsentry/sentry/commit/e932b15435bf36239431eaa3790a6bcfa47046a9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getsentry/sentry"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-130.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Improper authorization on debug and artifact file downloads"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2023-130

Vulnerability from pysec

cve-2023-36826

Vulnerability from cvelistv5

ghsa-m4hc-m2v6-hfw8

Vulnerability from github

Impact

Patches

References

Tags

Sightings

Nomenclature