Home > Vulnerability Database > CVE-2023-46729

Mend.io Vulnerability Database

CVE-2023-46729

Good to know:

Date: November 9, 2023

sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.

Language: TYPE_SCRIPT

Severity Score

9.3

Related Resources (9)

Url: https://github.com/getsentry/sentry-javascript/pull/9415

Url: https://blog.sentry.io/next-js-sdk-security-advisory-cve-2023-46729

Url: https://docs.sentry.io/platforms/javascript/guides/nextjs/manual-setup/#configure-tunneling-to-avoid-ad-blockers

Url: https://www.npmjs.com/package/@sentry/nextjs/v/7.77.0

Url: https://github.com/getsentry/sentry-javascript

Url: https://github.com/getsentry/sentry-javascript/commit/ddbda3c02c35aba8c5235e0cf07fc5bf656f81be

Url: https://github.com/getsentry/sentry-javascript/security/advisories/GHSA-2rmr-xw8m-22q9

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-46729

Url: https://www.mend.io/vulnerability-database/CVE-2023-46729

Severity Score

9.3

Weakness Type (CWE)

Server-Side Request Forgery (SSRF)

CWE-918

Top Fix

Upgrade Version

Upgrade to version @sentry/nextjs - 7.77.0

Learn More

CVSS v3.1

Base Score:	9.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2023-46729

Good to know:

Date: November 9, 2023

Language: TYPE_SCRIPT

Severity Score

Related Resources (9)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

Do you need more information?