GitLab · Report #2104591
Maintainer can leak sentry token by changing the configured URL (fix bypass)
Validstatus
mediumseverity
32upvotes
8 Oct 2024disclosed
Summary
A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the configured URL in the Sentry error tracking settings page. This was as a result of an incomplete fix for CVE-2022-4365.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.