// For flags

CVE-2024-32474

Sentry's superuser cleartext password leaked in logs

Severity Score

7.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.

Sentry es una plataforma de seguimiento de errores y supervisión del rendimiento. Antes de 24.4.1, al autenticarse como superusuario en Sentry con un nombre de usuario y contraseña, la contraseña se filtraba como texto plano en los registros bajo el _event_: `auth-index.validate_superuser`. Un atacante con acceso a los datos de registro podría utilizar estas credenciales filtradas para iniciar sesión en el sistema Sentry como superusuario. Los usuarios autohospedados de las versiones afectadas deben actualizar a 24.4.1 o posterior. Los usuarios pueden configurar el nivel de registro para excluir registros del nivel "INFO" y solo generar registros para niveles en "ADVERTENCIA" o más.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-12 CVE Reserved
  • 2024-04-18 CVE Published
  • 2024-04-19 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-117: Improper Output Neutralization for Logs
  • CWE-312: Cleartext Storage of Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Getsentry
Search vendor "Getsentry"
 Sentry
Search vendor "Getsentry" for product "Sentry"
 >= 24.3.0 < 24.4.1
Search vendor "Getsentry" for product "Sentry" and version " >= 24.3.0 < 24.4.1"
en
Affected