CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2024-32474
Medium (6.5) in sentry sentry. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in sentry 24.4.1.
Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-117, CWE-312
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sentry:sentry
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6cjm-4pxw-7xp9 | PyPI | sentry | >=24.3.0 <24.4.1 | 24.4.1 |
| PYSEC-2026-1911 | PyPI | sentry | >=24.3.0 <24.4.1 | 24.4.1 |
References
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f
- https://github.com/getsentry/sentry/pull/66393
- https://github.com/getsentry/sentry/pull/69148
- https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9
- https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f