Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-jv85-mqxj-3f9j

MediumCVSS 6.4 / 10
Published Dec 12, 2022·Last modified Oct 22, 2024
Affected Components(0)

No affected components available

Description

With a known valid invite link (i.e. not already accepted or expired) an unauthenticated attacker can manipulate the cookie to allow the same invite link to be reused on multiple accounts when joining an organization.

Impact

An attacker with a valid invite link can create multiple users and join the organization from which the invite link was generated.

Patches

This issue was patched in version 22.11.0.

Workarounds

Sentry SaaS customers do not need to take action.

Self-hosted Sentry installs can disable the invite functionality until they are ready to deploy the patched version by editing their sentry.conf.py file (usually located at ~/.sentry/).

  1. Add the following line into sentry.conf.py:

     SENTRY_FEATURES["organizations:invite-members"] = False

  2. Restart the Sentry web service.

    docker compose restart web

For more information

If you have any questions or comments about this advisory:

Risk Scores
Base Score
6.4

The vulnerability can be exploited over the network without needing physical access. It is difficult for an attacker to exploit this vulnerability and may require special conditions. An attacker does not need any special privileges or access rights. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a low impact on the integrity of the data. There is a low impact on the availability of the system.

Threat Intelligence
5.9

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
N/A

Probability that this vulnerability will be exploited in the wild within the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities
  • CVE-2022-23485
    Alias
  • EUVD-2022-0277
    Alias

Browse More

Medium severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard