Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a valid invite link can create multiple users and join an organization they may not have been originally invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action. Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at `~/.sentry/`).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library     prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same     invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a     valid invite link can create multiple users and join an organization they may not have been originally     invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action.
    Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until     they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at     `~/.sentry/`). (CVE-2022-23485)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library
    prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same
    invite link to be reused on multiple accounts when joining an organization. As a result an attacker with a
    valid invite link can create multiple users and join an organization they may not have been originally
    invited to. This issue was patched in version 22.11.0. Sentry SaaS customers do not need to take action.
    Self-hosted Sentry installs on systems which can not upgrade can disable the invite functionality until
    they are ready to deploy the patched version by editing their `sentry.conf.py` file (usually located at
    `~/.sentry/`). (CVE-2022-23485)

ID	Name	Product	Family	Severity
262405	Linux Distros Unpatched Vulnerability : CVE-2022-23485	Nessus	Misc.	low
416582	SCA: security update for sentry (GHSA-jv85-mqxj-3f9j)	Tenable Cloud Security	SCA Checks	low
416582	SCA: security update for sentry (GHSA-jv85-mqxj-3f9j)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2022-23485

low

Tenable Plugins

low

low

low