sentry software development kit vulnerabilities

Latest sentry software development kit CVEs

Newest publication first

1. CVE-2023-46729 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint

   Published 2023-11-10

   Medium·CVSS 6.1 EPSS 0.75%

   sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. Th...

2. CVE-2023-28117 Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`

   Published 2023-03-22

   Medium·CVSS 6.5 EPSS 0.65%

   Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.