| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| sentry | ≥ 23.6.0, < 23.6.2 | 23.6.2 |
| sentry | ≥ 23.6.0, < 23.6.2 | 23.6.2 |
The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default.
Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.
The patch has been released in Sentry 23.6.2.
For Sentry SaaS customers, no action is needed.
For self-hosted Sentry installations that have system.base-hostname explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン