CVE-2023-36829

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the "access-control-allow-credentials: true" HTTP header if the "Origin" request header ends with the "system.base-hostname" option of Sentry...

CVE-2023-36829: Permissive Cross-domain Policy with Untrusted Domains

Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry...