Vulnerability Description
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sentry | Sentry | >= 24.3.0, < 24.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a21695Patch
- https://github.com/getsentry/sentry/pull/66393Issue Tracking
- https://github.com/getsentry/sentry/pull/69148Issue Tracking
- https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9MitigationVendor Advisory
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a21695Patch
- https://github.com/getsentry/sentry/pull/66393Issue Tracking
- https://github.com/getsentry/sentry/pull/69148Issue Tracking
- https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9MitigationVendor Advisory
FAQ
What is CVE-2024-32474?
CVE-2024-32474 is a vulnerability with a CVSS score of 7.3 (HIGH). Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs...
How severe is CVE-2024-32474?
CVE-2024-32474 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-32474?
Check the references section above for vendor advisories and patch information. Affected products include: Sentry Sentry.