CVE-2024-45605 - CVE House

Back to Database

Status published Medium CVE-2024-45605

Improper authorization on deletion of user issue alert notifications in sentry

6.5 CVSS

Vulnerability Description

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-45605

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from getsentry

View All →

Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Improper authentication on SAML SSO process allows user impersonation in sentry

Sentry's improper error handling leaks Application Integration Client Secret

Improper authorization on muting of alert rules in sentry

Affected Vendor

getsentry

View all reports →

Affected Software

sentry

Vulnerable Versions:

>=23.9.0, < 24.9.0

Timeline

Official Publish: September 17th, 2024

Last Modified: September 18th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1213 Data from Information Repositories

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Privilege Escalation