CVE-2023-39349: Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Impact An attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.
There is no evidence that the issue was exploited on https://sentry.io. For self-hosted users, it is advised to rotate user auth tokens via https://your-self-hosted-sentry-installation/settings/account/api/auth-tokens/.
Patches The issue was fixed in https://github.com/getsentry/sentry/pull/53850 and is available in the release 23.7.2 of sentry and self-hosted.
Workarounds There are no known workarounds.
Other sources
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests. There is no evidence that the issue was exploited on sentry.io. For self-hosted users, it is advised to rotate user auth tokens. A fix is available in version 23.7.2 of sentry and self-hosted. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-39349.
What is the severity of CVE-2023-39349?
The severity of CVE-2023-39349 is high, with a severity value of 8.1.
What is the impact of CVE-2023-39349?
An attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.
Is there any evidence of exploitation for CVE-2023-39349?
There is no evidence that the issue was exploited on https://sentry.io.
How can I fix CVE-2023-39349?
To fix CVE-2023-39349, update the Sentry package to version 23.7.2 or later.