# CVE-2024-53253: Sentry information disclosure in Search UI component error handling

Source: https://junglewise.ai/threats/cve-2024-53253-sentry-information-disclosure-in-search-ui-component-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-22. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2024-53253 · Severity: medium · CVSS 5.3 · Published 2024-11-22

Sentry, an application monitoring platform, was found to leak sensitive integration credentials in certain error messages. When a user interacts with specific search components that fail to validate third-party responses, the system may return the integration's Client ID and Client Secret in plaintext within the HTTP response. While these credentials alone do not grant full access to data, they could be used by an attacker who has also obtained a valid API token to compromise application integrations.

Technologies: [sentry (PyPI)](https://junglewise.ai/threats/technologies/pypi-sentry). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-53253 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-53253 being exploited in the wild.

**How severe is CVE-2024-53253?** Medium severity, with a CVSS score of 5.3, published 22 November 2024.

**Which products and versions are affected?** sentry (PyPI) ECOSYSTEM:introduced=0,last_affected=24.11.0, ECOSYSTEM:introduced=24.11.0,fixed=24.11.1.

**Is there a fix for CVE-2024-53253?** Yes. sentry (PyPI): upgrade to 24.11.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-53253 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-53253?** Check whether you run sentry (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sentry (PyPI): upgrade to 24.11.1 or later

  ```sh
  pip install "sentry>=24.11.1"
  ```


## Technical details

An information disclosure vulnerability exists in Sentry due to improper error handling in the 'select-requester' component. When a Search UI component with the 'async' flag enabled receives an invalid response from a third-party service, Sentry returns a 'select-requester.invalid-response' error. This error message includes a serialized version of the Sentry application, which contains the plaintext Client ID and Client Secret. The vulnerability is rooted in 'src/sentry/sentry_apps/external_requests/select_requester.py'. Attackers can observe these secrets in the underlying HTTP response, though they are not rendered in the UI. A fix is available in version 24.11.1.

## Affected products

- Sentry Sentry 24.11.0

## Identifiers

- CVE-2024-53253
- GHSA-v5h2-q2w4-gpcx
- PYSEC-2024-310

## Timeline

- 2024-11-22: advisory: GHSA-v5h2-q2w4-gpcx published
- 2024-11-22: patched: Sentry version 24.11.1 released

## References

- [https://api.github.com/users/Christinarlong](https://api.github.com/users/Christinarlong)
- [https://github.com/Christinarlong](https://github.com/Christinarlong)
- [https://api.github.com/users/Christinarlong/gists%7B/gist_id%7D](https://api.github.com/users/Christinarlong/gists%7B/gist_id%7D)
- [https://api.github.com/users/Christinarlong/repos](https://api.github.com/users/Christinarlong/repos)
- [https://avatars.githubusercontent.com/u/60594860?v=4](https://avatars.githubusercontent.com/u/60594860?v=4)
- [https://api.github.com/users/Christinarlong/events%7B/privacy%7D](https://api.github.com/users/Christinarlong/events%7B/privacy%7D)

## Related threats

- [PYSEC-2026-1916 - Sentry improperly authorizes muting of alert rules](https://junglewise.ai/threats/cve-2024-45606-sentry-improperly-authorizes-muting-of-alert-rules)
- [PYSEC-2026-1910 - Sentry improperly authorizes deletion of user issue alert notifications](https://junglewise.ai/threats/cve-2024-45605-sentry-improperly-authorizes-deletion-of-user-issue-alert)
- [PYSEC-2026-1914 - Sentry vulnerable to stored Cross-Site Scripting (XSS)](https://junglewise.ai/threats/cve-2024-41656-sentry-vulnerable-to-stored-cross-site-scripting-xss)
- [PYSEC-2026-1913 - Slack integration leaks sensitive information in logs](https://junglewise.ai/threats/cve-2024-35196-slack-integration-leaks-sensitive-information-in-logs)
- [PYSEC-2026-1911 - Sentry vulnerable to leaking superuser cleartext password in logs](https://junglewise.ai/threats/cve-2024-32474-sentry-vulnerable-to-leaking-superuser-cleartext-password-in-logs)