CVE-2024-45605

{"id": "CVE-2024-45605", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-09-17T20:15:05.120", "references": [{"url": "https://github.com/getsentry/self-hosted", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getsentry/sentry/pull/77093", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Sentry es una plataforma de monitoreo de rendimiento y seguimiento de errores que prioriza a los desarrolladores. Un usuario autenticado elimina las notificaciones de alerta de emisi\u00f3n de usuario para usuarios arbitrarios a partir de una ID de alerta conocida. Se emiti\u00f3 un parche para garantizar que las verificaciones de autorizaci\u00f3n tengan el alcance adecuado en las solicitudes de eliminaci\u00f3n de notificaciones de alerta de usuario. Los usuarios de Sentry SaaS no necesitan realizar ninguna acci\u00f3n. Los usuarios de Sentry alojado en servidores propios deben actualizar a la versi\u00f3n 24.9.0 o superior. No existen workarounds para esta vulnerabilidad."}], "lastModified": "2024-09-26T19:14:00.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E6FD59C-D86A-4163-9245-EC4000DC98FC", "versionEndExcluding": "24.9.0", "versionStartIncluding": "23.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}