CVE-2024-32474

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32474
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32474.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32474
Aliases
Published
2024-04-18T19:50:44.541Z
Modified
2026-04-10T05:12:13.856827Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Sentry's superuser cleartext password leaked in logs
Details

Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validate_superuser. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the INFO level and only generate logs for levels at WARNING or more.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-117",
        "CWE-312"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32474.json"
}
References

Affected packages

Git / github.com/getsentry/sentry

Affected ranges

Type
GIT
Repo
https://github.com/getsentry/sentry
Events
Introduced
0a10a6673af4dddf789eed5da132a20f2ff2f4f3
Fixed
db71b8db26d741bb686c6a4876c0bc5f73af80c9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32474.json"