Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`

CVE-2023-28117

What is CVE-2023-28117?

The Sentry Python SDK, particularly its Django integration, has a vulnerability that allows sensitive cookie values, such as session cookies, to be leaked when certain conditions are met. If the 'sendDefaultPII' option is enabled and custom names for cookie settings are used without proper configuration for data scrubbing, attackers with access to Sentry issues may exploit this to impersonate users or escalate privileges within the application. Users should upgrade to version 1.14.0 or later to benefit from enhanced security measures that automatically detect and filter these cookie names.

References