sentry@23.1.0 vulnerabilities
A realtime logging and aggregation server.
-
latest version
23.7.1
-
first published
13 years ago
-
latest version published
a year ago
-
licenses detected
- [10.0.0,)
Direct Vulnerabilities
Known vulnerabilities in the sentry package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Integration platform integration which allows the storage of arbitrary HTML tags. An attacker can execute arbitrary scripts in the context of a user's browser by sending an unsanitized payload that is subsequently rendered on the Issues page. This is only exploitable if untrustworthy Integration platform integrations send external issues to the Sentry instance. Note: This vulnerability was fixed in version 24.7.1. How to fix Cross-site Scripting (XSS)? A fix was pushed into the |
[10.0.0,)
|
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via Phabricator integration, which does not properly sanitize input. An attacker could exploit this by making the application send POST HTTP requests to arbitrary URLs, including internal IP addresses. This could allow the attacker to interact with the internal network or scan local/remote ports. Note: This is only exploitable if an attacker has access to a Sentry instance. How to fix Server-Side Request Forgery (SSRF)? A fix was pushed into the |
[9.1.0,)
|
Affected versions of this package are vulnerable to Improper Authentication. An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. How to fix Improper Authentication? A fix was pushed into the |
[0,)
|
Affected versions of this package are vulnerable to Access Control Bypass via the How to fix Access Control Bypass? A fix was pushed into the |
[22.1.0,)
|
Affected versions of this package are vulnerable to Improper Authorization such that an authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. Note: The user does not need to be a member of the organization or have permissions on the project. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them. Sentry SaaS users do not need to take any action. How to fix Improper Authorization? Upgrade |
[8.21.0,23.5.2)
|