CVE-2023-40577 — Cross-site Scripting in Prometheus Alertmanager

CWE-79 — Cross-site Scripting9 documents7 sources
Severity
5.4MEDIUMNVD
EPSS
3.6%
top 12.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Prometheus AlertmanagerDebian Prometheus-alertmanagerPrometheus Alertmanager+1 more
Timeline
PublishedAug 25
Latest updateJan 15

Description

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages4 packages

▶debiandebian/prometheus-alertmanager< prometheus-alertmanager 0.26.0+ds-1 (forky)
▶CVEListV5prometheus/alertmanager0.25.0

Also affects: Debian Linux 10.0

🔴Vulnerability Details

4
OSV
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager↗2024-08-21
▶
OSV
CVE-2023-40577: Alertmanager handles alerts sent by client applications such as the Prometheus server↗2023-08-25
▶
OSV
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint↗2023-08-23
▶
GHSA
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint↗2023-08-23
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (Golang Go) — CVE-2023-40577↗2025-01-15
▶
Ubuntu
Prometheus Alertmanager vulnerability↗2024-07-31
▶
Red Hat
prometheus-alertmanager: UI is vulnerable to stored XSS via the /api/v1/alerts endpoint↗2023-08-24
▶
Debian
CVE-2023-40577: prometheus-alertmanager - Alertmanager handles alerts sent by client applications such as the Prometheus s...↗2023
▶