CVE-2019-3826
Medium
Description
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
SeverityMedium
CVSS6.1
Exploit probability—
Product
Prometheus
PublishedMar 26, 2019
First seenMar 26, 2019
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- prometheus prometheus2.7.1 or later
- github.com/prometheus/prometheus2.7.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prometheus prometheus | v < 2.7.1 | 2.7.1 |
| redhat openshift_container_platform | 3.11 | — |
| github.com/prometheus/prometheusGo | v < 2.7.1 | 2.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.