SB2022121027 - Improper access control in sentry

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2022-23485)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to join an organization with multiple accounts using the same invite link.

The vulnerability exists due to improper access control in the invite link handling functionality when processing a manipulated cookie during organization signup. A remote attacker can manipulate the cookie and reuse a known valid invite link to join an organization with multiple accounts.

User interaction is required because exploitation depends on use of a valid invite link that has not already been accepted or expired.

Remediation

Install update from vendor's website.

References

• https://github.com/getsentry/sentry/security/advisories/GHSA-jv85-mqxj-3f9j
• https://github.com/advisories/GHSA-jv85-mqxj-3f9j