CVE-2023-39531
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Sentry, an error tracking and performance monitoring platform, there is a vulnerability that allows an attacker to retrieve a valid access token for another user during the OAuth token exchange. This issue affects versions from 10.0.0 to prior to 23.7.2 due to incorrect credential validation.
Risk Assessment
An attacker with sufficient client-side exploits could gain access to other users' data, posing a serious threat to privacy and data security within the organization.
Recommendation
It is recommended to upgrade to version 23.7.2 or higher for self-hosted installations. Users should also review applications authorized on their account and remove any that are no longer needed.
Original NVD description (English source)
Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. Sentry SaaS customers do not need to take any action. Self-hosted installations should upgrade to version 23.7.2 or higher. There are no direct workarounds, but users should review applications authorized on their account and remove any that are no longer needed.