CVE-2024-45605 json
Improper authorization on deletion of user issue alert notifications in sentry
published 2y ago modified 4mo ago also EUVD-2024-2716 , GHSA-54m3-95j9-v89j , PYSEC-2026-1910
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications. Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 24.9.0 or higher. There are no known workarounds for this vulnerability.
Patch / fix
- pypi sentry 24.9.0
- sentry sentry 24.9.0
- github.com/getsentry/sentry@5902582 commit
- github.com/getsentry/sentry#77093 pull request
Is CVE-2024-45605 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | sentry | >=23.9.0, <24.9.0 |
24.9.0 |
Affected products
- getsentry sentry
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/getsentry/sentry/pull/77093
web, issue-tracking, patch
-
github.com
/getsentry/sentry/commit/590258255bcb3a5fa4c56f21297b6c99131cfb9d
web
-
github.com
/getsentry/sentry/security/advisories/GHSA-54m3-95j9-v89j
web, vendor-advisory
-
github.com
/getsentry/self-hosted
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2024-45605
advisory
-
github.com
/getsentry/sentry
package
-
pypi.org
/project/sentry
package
-
github.com
/advisories/GHSA-54m3-95j9-v89j
advisory
Sources
- CVE List CVE-2024-45605
- GitHub Advisory GHSA-54m3-95j9-v89j
- NVD CVE-2024-45605
- OSV PYSEC-2026-1910
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.