Information Leakage

2024-07-1907:19:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sentry-sdk

information leakage

subprocess calls

environment variables

vulnerability

stdlib integration

attacker

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

JSON

Sentry-sdk is vulnerable to Information Leakage. The vulnerability is due to subprocess calls leaking environment variables when the Stdlib integration is enabled, which could allow an attacker to gain access to sensitive environment variables by exploiting the unintended passing of these variables to subprocesses calls.