CVE-2024-32474

CVSS 3.1 Score 7.3 of 10 (high)

Details

Published Apr 18, 2024
Updated: Apr 19, 2024
CWE ID 312
CWE ID 117

Summary

CVE-2024-32474 is a vulnerability in the Sentry error tracking and performance monitoring platform. It affects versions prior to 24.4.1. The vulnerability allows the password of a superuser to be leaked in cleartext in logs under the event "auth-index.validate_superuser". An attacker with access to these logs could use the leaked credentials to login as a superuser. To remediate the issue, self-hosted users should upgrade to version 24.4.1 or later. Additionally, users can configure the logging level to exclude logs at the "INFO" level and only generate logs for levels at "WARNING" or higher. The vulnerability poses a high risk as it can potentially lead to unauthorized access and compromise sensitive information within an organization's Sentry system.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-32474 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options