CVE-2023-40577
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Summary
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Original description
The description as published by the source.
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
alertmanager
[{"type":"SEMVER","events":[{"introduced":"0.25.0"},{"fixed":"0.25.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-40577 prometheus-alertmanager
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web lists.debian.org