GHSA-m4hc-m2v6-hfw8: Improper authorization on debug and artifact file downloads

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-36826

Improper authorization on debug and artifact file downloads

High severity GitHub Reviewed Published Jul 25, 2023 in getsentry/sentry • Updated Jul 25, 2023

Affected versions

>= 8.21.0, < 23.5.2

Description

Impact

An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project.

Patches

A patch was issued to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them.

Sentry SaaS users do not need to take any action. Self-Hosted Sentry users should upgrade to version 23.5.2 or higher.

References

• Restrict file downloads to Project

References

• GHSA-m4hc-m2v6-hfw8
• getsentry/sentry#49680
• getsentry/sentry@e932b15

Published to the GitHub Advisory Database

Jul 25, 2023

Last updated

Jul 25, 2023