GitHub Advisoryadvisory · Go

GHSA-v86x-5fm3-5p7j Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

MEDIUM Published 2023-08-23 Modified 2023-09-01 Official page ↗
Aliases
CVE-2023-40577
Ecosystem
Go
Packages
github.com/prometheus/alertmanager
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-08-23

Affected packages

• Go github.com/prometheus/alertmanager: < 0.25.1 → fixed in 0.25.1

Description

Impact An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. Patches Users can upgrade to Alertmanager v0.2.51. Workarounds Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint. References N/A

Related

Alias · CVE (1)

  • CVE-2023-40577 Alertmanager handles alerts sent by client applications such as the Prometheus server. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References