Read the docs
TI-2023-26759 Aliases CVE-2023-49094

Symbolicator Server Side Request Forgery vulnerability

Priority LOW 21CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00705 53rd percentileScored 2026-11-07
Fix Fixed symbolicator (getsentry): 23.11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getsentrysymbolicator0.3.3 to before 23.11.223.11.2Patch availableCNA
  • symbolicator Vendorgetsentry Affected 0.3.3 to before 23.11.2 Fixed in 23.11.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sentry:symbolicator:*:*:*:*:*:*:*:*0.3.3 to before 23.11.2VulnerableSentry
  • cpe:2.3:a:sentry:symbolicator:*:*:*:*:*:*:*:* Versions 0.3.3 to before 23.11.2 Vulnerable ·Sentry

Remediation

  • Fix · CNA symbolicator (getsentry) Fixed in 23.11.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49094

References

Patch 1

Advisory 3

  • TI-2026-21018 Sentry allows unauthorized access to event data across organizational boundaries CVSS 4.0MEDIUM 5.7
  • TI-2026-30656 Sentry: Improper authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.8
  • TI-2026-78982 Sentry-Javascript: Middleware Bypass when using Tunnel route CVSS 4.0CRITICAL 9.1
  • TI-2025-16094 Improper authentication on SAML SSO process allows user impersonation in sentry CVSS 3.1CRITICAL 9.1
  • TI-2023-25212 Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint CVSS 3.1CRITICAL 9.3
  • TI-2026-21634 Sentry: Improper Authentication on SAML SSO process allows user identity linking CVSS 3.1CRITICAL 9.1
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences