GHSA-v86x-5fm3-5p7j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-v86x-5fm3-5p7j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-v86x-5fm3-5p7j/GHSA-v86x-5fm3-5p7j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-v86x-5fm3-5p7j
- Aliases
- Related
- Published
- 2023-08-23T20:42:43Z
- Modified
- 2024-09-11T06:12:25.613166Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
- Details
-
Impact
An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.
Patches
Users can upgrade to Alertmanager v0.2.51.
Workarounds
Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.
References
N/A
- References
Affected packages
Go / github.com/prometheus/alertmanager
Package
- Name
- github.com/prometheus/alertmanager
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/prometheus/alertmanager