CVE-2024-41656

Advisory

An unsanitized payload sent by an Integration platform integration allows the storage of arbitrary HTML tags on the Sentry side. This payload could subsequently be rendered on the Issues page, creating a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability might lead to the execution of arbitrary scripts in the context of a user’s browser. Self-hosted Sentry users may be impacted if untrustworthy Integration platform integrations send external issues to their Sentry instance.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-fm88-hc3v-3www
• https://github.com/getsentry/sentry/pull/74648
• https://github.com/getsentry/sentry/commit/5c679521f1539eabfb81287bfc30f34dbecd373e
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41656