CVE-2023-39338

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.

Metrics

CVSS 3.0 6.8/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jul 12, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-393394.9A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fiCVE-2023-393407.5A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead toCVE-2023-393413.3"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to deniCVE-2023-393423.6Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-CVE-2023-393434.3Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which useCVE-2023-393448.8social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, whCVE-2023-393457.5strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the uCVE-2023-393469.8LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21CVE-2023-393479.0Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labelsCVE-2023-393485.3Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL alwaCVE-2023-393498.1Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with acCVE-2023-39359.8A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacke