{"id":"GHSA-4xqm-4p72-87h6","summary":"Sentry CORS misconfiguration","details":"### Impact\nThe Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default.\n\nImpact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.\n\n### Patches\nThe patch has been released in [Sentry 23.6.2](https://github.com/getsentry/self-hosted/releases/tag/23.6.2).\n\n### Workarounds\n\nFor Sentry SaaS customers, no action is needed.\n\nFor self-hosted Sentry installations that have `system.base-hostname` explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.\n\n### References\n- [getsentry/sentry PR #52276](https://github.com/getsentry/sentry/pull/52276)\n\n### Credits\n- [@andr0idp4r4n0id](https://twitter.com/andr0idp4r4n0id)","aliases":["CVE-2023-36829","PYSEC-2023-115"],"modified":"2026-09-10T03:50:08.444402599Z","published":"2023-07-06T22:55:44Z","database_specific":{"cwe_ids":["CWE-697","CWE-863","CWE-942"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-07-06T22:55:44Z","nvd_published_at":"2023-07-06T23:15:09Z"},"references":[{"type":"WEB","url":"https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36829"},{"type":"WEB","url":"https://github.com/getsentry/sentry/pull/52276"},{"type":"WEB","url":"https://github.com/getsentry/sentry/commit/19248fb9802c252665b802aeab02fdc65ed47dc9"},{"type":"WEB","url":"https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b"},{"type":"WEB","url":"https://github.com/getsentry/self-hosted/releases/tag/23.6.2"},{"type":"PACKAGE","url":"https://github.com/getsentry/sentry"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-115.yaml"}],"affected":[{"package":{"name":"sentry","ecosystem":"PyPI","purl":"pkg:pypi/sentry"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.6.0"},{"fixed":"23.6.2"}]}],"versions":["23.6.0","23.6.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-4xqm-4p72-87h6/GHSA-4xqm-4p72-87h6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}]}