CVE-2025-65944
BaseFortify
Publication date: 2025-11-25
Last updated on: 2025-11-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sentry | sentry_javascript | 10.27.0 |
| sentry | sentry_javascript | 10.11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Sentry-Javascript SDK versions from 10.11.0 to before 10.27.0 when the configuration option sendDefaultPii is set to true. In this case, certain sensitive HTTP headers, including the Cookie header, can be inadvertently sent to Sentry and stored within the Sentry organization as part of the associated trace. This exposure allows anyone with access to the Sentry organization to view and potentially misuse these sensitive values to impersonate users or escalate privileges within the application. The issue was fixed in version 10.27.0.
How can this vulnerability impact me? :
If you use the affected versions of the Sentry-Javascript SDK with sendDefaultPii set to true, sensitive HTTP headers such as cookies may be exposed to anyone with access to your Sentry organization. This can lead to unauthorized access, user impersonation, and privilege escalation within your application, potentially compromising the security and integrity of your system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can lead to the unintended exposure of sensitive personal data (such as cookies) to unauthorized parties, which may violate data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information. Therefore, it can negatively impact compliance with these standards by risking unauthorized data disclosure.
What immediate steps should I take to mitigate this vulnerability?
Upgrade the Sentry-Javascript SDK to version 10.27.0 or later, as this version contains the patch that fixes the vulnerability related to sending sensitive HTTP headers when sendDefaultPii is set to true.