Security readout for executives and security teams
Plain-English summary
Sentry 8.2.0, a popular error-tracking platform, contains a flaw that lets an authenticated superuser run commands on the server by submitting a specially crafted entry through the admin audit log. Because the attacker must already hold the highest privilege role, the risk is concentrated in environments where superuser accounts are loosely guarded or shared.
Executive priority
Treat as a high-priority patch for any self-hosted Sentry 8.2.0 instance. Successful exploitation yields code execution on a server that often holds source paths, stack traces, and customer error data, making it a credible foothold for broader compromise even though attacker pre-conditions are non-trivial.
Technical view
The audit log entry endpoint accepts a base64-encoded, compressed pickle blob in the data field and deserializes it without validation, triggering arbitrary object instantiation (CWE-94). A superuser-authenticated POST can therefore achieve code execution under the Sentry application account. CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). The issue is documented against Sentry 8.2.0 per VulnCheck and ExploitDB 50318.
Likely exposure
Self-hosted Sentry 8.2.0 deployments with superuser accounts exposed to operators or shared service identities. Sentry SaaS users are not in scope. The bug is post-authentication and gated by the superuser role, so internet-facing instances with weak admin credentials face the greatest exposure.
Exploitation context
Public proof-of-concept exists on ExploitDB (50318) and the VulnCheck advisory, but the CVE is not in CISA KEV and no in-the-wild activity is cited in the bundle. Exploitation requires valid superuser credentials, which limits opportunistic attacks while elevating insider and credential-theft risk.
Researcher notes
Root cause is unsafe pickle deserialization in the audit log entry data parameter (CWE-94). Useful detection ideas: alert on POSTs to the admin audit log endpoint with base64 data fields, and on Sentry worker processes spawning shells or network egress. Validate the fix by confirming the deserializer rejects or sandboxes pickled inputs; consult vendor changelogs rather than assuming a specific fixed version.
Mitigation direction
- Upgrade self-hosted Sentry beyond 8.2.0 per current vendor guidance at sentry.io.
- Restrict superuser role assignment and require unique, MFA-protected admin accounts.
- Place the Sentry admin interface behind a VPN or IP allowlist.
- Rotate any superuser credentials suspected of exposure or shared use.
- Monitor audit log endpoints for anomalous POST traffic with large payloads.
Validation and detection
- Inventory Sentry deployments and confirm whether any run version 8.2.0.
- Enumerate accounts holding the superuser flag and confirm business need.
- Review web and proxy logs for POSTs to admin audit log routes containing base64 data.
- Check vendor release notes for the fixed version that supersedes 8.2.0.
- Confirm the admin interface is not reachable from untrusted networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47935 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50318CVE reference, VulnCheck · exploit
- Product ReferenceCVE reference, VulnCheck · product
- VulnCheck Advisory: Sentry 8.2.0 Remote Code Execution via Pickle DeserializationCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.