CVE-2023-51451
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Summary
CVE-2023-51451 is a vulnerability affecting Symbolicator, a component used in Sentry. Versions prior to 21.12.1 of Symbolicator contain a flaw that allows attackers to manipulate Symbolicator into sending GET HTTP requests to unintended internal IP addresses via an invalid protocol. The responses from these requests could be exposed through Symbolicator's API, leading to potential data exposure in affected Sentry instances. This issue is rectified in Symbolicator release 23.12.1 and Sentry self-hosted release 23.12.1. Users unable to update immediately can mitigate the risk by disabling JavaScript processing, disabling untrusted public repositories, or disabling Symbolicator entirely. The vulnerability was patched on sentry.io on December 18, 2023.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Sentry
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions