CVE-2019-3826

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*"
            ],
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "3.11"
                }
            ],
            "vendor_product": "redhat:openshift_container_platform"
        }
    ]
}

References

CVE-2019-3826

Affected packages