CVE-2023-49094

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if they have an account on Sentry instance. The issue has been fixed in the release 23.11.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
getsentry	symbolicator	>= 0.3.3, < 23.11.2

References

https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865aPatch, Vendor Advisory
https://github.com/getsentry/symbolicator/pull/1332Vendor Advisory
https://github.com/getsentry/symbolicator/releases/tag/23.11.2Release Notes, Vendor Advisory
https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6Mitigation, Vendor Advisory
https://github.com/getsentry/symbolicator/commit/9db2fb9197dd200d62aacebd8efef4df7678865aPatch, Vendor Advisory
https://github.com/getsentry/symbolicator/pull/1332Vendor Advisory
https://github.com/getsentry/symbolicator/releases/tag/23.11.2Release Notes, Vendor Advisory
https://github.com/getsentry/symbolicator/security/advisories/GHSA-6576-pr6j-h9c6Mitigation, Vendor Advisory

Timeline

Published: Nov 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-490957.5nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate an CVE-2023-490968.8Jellyfin is a Free Software Media System for managing and streaming media. In affected versions there is an argument injection in the Videos CVE-2023-490978.8ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to buil CVE-2023-490983.5Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exp CVE-2023-490994.3Discourse is a platform for community discussion. Under very specific circumstances, secure upload URLs associated with posts can be accesse CVE-2023-49105.5A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, t CVE-2023-491004.4Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is n CVE-2023-491016.1WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mi CVE-2023-491028.8NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. CVE-2023-491037.5An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party Ge CVE-2023-491046.1An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted CVE-2023-491059.8An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication