CVE-2023-36829

Advisory

The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default. The impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b
• https://github.com/advisories/GHSA-4xqm-4p72-87h6
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36829