CVE-2023-36829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-36829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-36829
Aliases
Published
2023-07-06T22:08:58Z
Modified
2026-10-21T02:49:52Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Sentry CORS misconfiguration vulnerability
Details

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default. Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks. The patch has been released in Sentry 23.6.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-863",
        "CWE-942"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36829.json"
}
References

Affected packages

Git / github.com/getsentry/self-hosted

Affected ranges

Type
GIT
Repo
https://github.com/getsentry/self-hosted
Events
Introduced
dbded584377d50a2545a98de5d0d53d204b369a0
Fixed
5c5bf06fae3ac6b8c60b4770d4ac985ea670103f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "23.6.0"
                },
                {
                    "fixed":  "23.6.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "original_tag":  "23.6.2",
            "range":  [
                {
                    "fixed":  "5c5bf06fae3ac6b8c60b4770d4ac985ea670103f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "cpe":  "cpe:2.3:a:functional:sentry:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "23.6.0"
                },
                {
                    "fixed":  "23.6.2"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/getsentry/sentry
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ee44c6be35e5e464bc40637580f39867898acd8b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "ee44c6be35e5e464bc40637580f39867898acd8b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.10.0
1.10.1
1.11.0
1.11.1
1.11.2
1.11.3
1.4.3
1.6.2
1.6.4
1.6.5
1.6.7
1.6.8
1.6.8.1
1.7.3
1.8.8
2.*
2.0.0
2.0.0-RC5
2.0.0-RC7
2.0.0-RC9
2.0.1
2.0.2
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.7.0
2.8.0
2.8.1
2.9.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.2.0
3.3.0
3.3.1
3.3.2
3.4.0
3.4.1
3.4.2
3.5.0
3.5.1
3.5.2
3.5.3
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.8.0
3.8.1
4.*
4.0.0
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.10.0
4.2.0
4.2.1
4.2.2
4.2.4
4.2.5
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.6.0
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.7
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.9.0
4.9.4
4.9.5
4.9.6
4.9.7
4.9.7.1
4.9.8
5.*
5.1.0
5.1.1
5.1.1.1
5.1.1.2
5.1.2
5.1.3
5.1.4
5.1.5
5.2.0
5.2.1
5.3.0
5.3.1
5.3.2
5.3.3
6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.1.0
6.1.1
6.1.2
6.2.0
6.2.1
6.2.2
6.2.3
8.*
8.0.0
8.0.0-rc1
8.1.0
v1.*
v1.10.0
v1.10.1
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.6.2
v1.6.4
v1.6.5
v1.6.7
v1.6.8
v1.6.8.1
v1.7.3
v1.8.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36829.json"