« Volver al listado

CVE-2025-53073

Estado: AplazadaMedia (4.2)—

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) without being a member of the project's team. A seven-digit issue ID must be known (it is not treated as a secret and might be mentioned publicly, or it could be predicted).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sentry — SentryAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53073",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53073",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-24T19:18:05.310947Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Sentry",
          "product": "Sentry",
          "versions": [
            {
              "status": "affected",
              "version": "25.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "25.5.1"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-06-24T18:15:26.813",
  "references": [
    {
      "url": "https://github.com/getsentry/self-hosted/releases",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/nikolas-ch/CVEs/blob/main/Sentry_Version%3E%3D25.1.0/Sentry_%3E%3D25.1.0_WeakAuthorizationControl.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/nikolas-ch/CVEs/tree/main/Sentry_Version%3E%3D25.1.0",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) without being a member of the project's team. A seven-digit issue ID must be known (it is not treated as a secret and might be mentioned publicly, or it could be predicted)."
    },
    {
      "lang": "es",
      "value": "En Sentry 25.1.0 a 25.5.1, un atacante autenticado puede acceder al endpoint de incidencia de un proyecto y realizar acciones no autorizadas (como añadir un comentario) sin ser miembro del equipo del proyecto. Se debe conocer un ID de incidencia de siete dígitos (no se trata como secreto y puede mencionarse públicamente o predecirse)."
    }
  ],
  "lastModified": "2026-06-17T09:37:35.070",
  "sourceIdentifier": "cve@mitre.org"
}