CVE-2024-45606 json
Improper authorization on muting of alert rules in sentry
published 2024-09-17 2 y ago modified 2026-07-07 4 mo ago also EUVD-2024-2875 , GHSA-v345-w9f2-mpm5 , PYSEC-2026-1916
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user can mute alert rules from arbitrary organizations and projects with a know rule ID. The user does not need to be a member of the organization or have permissions on the project. In our review, we have identified no instances where alerts have been muted by unauthorized parties. A patch was issued to ensure authorization checks are properly scoped on requests to mute alert rules. Authenticated users who do not have the necessary permissions are no longer able to mute alerts. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version **24.9.0** or higher. The rule mute feature was generally available as of 23.6.0 but users with early access may have had the feature as of 23.4.0. Affected users are advised to upgrade to version 24.9.0. There are no known workarounds for this vulnerability.
Patch / fix
- pypi sentry 24.9.0
- sentry sentry 24.9.0
- github.com/getsentry/sentry@e8e7170 commit
- github.com/getsentry/sentry#77016 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| GitHub | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | sentry | >=23.4.0, <24.9.0 |
24.9.0 |
Affected products
- getsentry sentry
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/getsentry/sentry/pull/77016
web, patch
-
github.com
/getsentry/sentry/commit/e8e71708758e1f9f56ce815ace73fe60d9e608dc
web
-
github.com
/getsentry/sentry/security/advisories/GHSA-v345-w9f2-mpm5
web, vendor-advisory
-
github.com
/getsentry/self-hosted
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2024-45606
advisory
-
github.com
/getsentry/sentry
package
-
pypi.org
/project/sentry
package
-
github.com
/advisories/GHSA-v345-w9f2-mpm5
advisory
Sources
- CVE List CVE-2024-45606
- GitHub Advisory GHSA-v345-w9f2-mpm5
- NVD CVE-2024-45606
- OSV PYSEC-2026-1916
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.