CVE-2024-32474 json
Sentry's superuser cleartext password leaked in logs
published 2024-04-18 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1123 , GHSA-6cjm-4pxw-7xp9 , PYSEC-2026-1911
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
Patch / fix
- pypi sentry 24.4.1
- functional sentry 24.4.1
- sentry sentry 24.4.1
- github.com/getsentry/sentry@d5b3456 commit
- github.com/getsentry/sentry#66393 pull request
- github.com/getsentry/sentry#69148 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | sentry | >=24.3.0, <24.4.1 |
24.4.1 |
Affected products
- getsentry sentry
Classification
References
-
github.com
/getsentry/sentry/pull/66393
web, issue-tracking
-
github.com
/getsentry/sentry/pull/69148
web, issue-tracking
-
github.com
/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f
web, patch
-
github.com
/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-32474
advisory
-
github.com
/getsentry/sentry
package
-
pypi.org
/project/sentry
package
-
github.com
/advisories/GHSA-6cjm-4pxw-7xp9
advisory
Sources
- CVE List CVE-2024-32474
- GitHub Advisory GHSA-6cjm-4pxw-7xp9
- NVD CVE-2024-32474
- OSV PYSEC-2026-1911
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.