[Security Advisory]: CVE-2024-45606 - Improper authorization on muting of alert rules

[geoffg-sentry]

Package and Versions

Package: sentry
Affected Version(s): >=23.4.0, <= 24.8.0
Patched Version(s): 24.9.0

Description

An authenticated user can mute alert rules from arbitrary organizations and projects given a known given rule ID. The user does not need to be a member of the organization or have permissions on the project.

Impact

In our review, we have identified no instances where alerts have been muted by unauthorized parties.

Patches

• Self-hosted users on affected versions should upgrade to 24.9.0 or later.
• Sentry SaaS users do not need to take any action.

Workarounds

No workarounds are available.

CVSS 3.1 Score and Vector

CVSS Score: 7.1
CVSS Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Information

• Security Advisory
• Bug introduced in for Early Adopters in feat(rulesnooze): Add delete endpoint sentry#47285
• Bug for General Availability in feat(rulesnooze): Remove feature flag backend sentry#50680
• Security fix in fix(alerts): Prevent muting alerts sentry#77016
• Credit: @emanuelbeni