CVE-2022-46146
Medium
Description
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
SeverityMedium
CVSS6.2
Exploit probability—
Product
Prometheus Exporter Toolkit
PublishedNov 29, 2022
First seenNov 29, 2022
Weakness typeCWE-303CWE-303CWE-287Improper authentication
How to fix
Update
- prometheus exporter_toolkit0.7.2, 0.8.2 or later
- github.com/prometheus/exporter-toolkit0.7.2, 0.8.2 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA/
- security.gentoo.org/glsa/202401-15
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prometheus exporter_toolkit | v < 0.7.2, 0.8.0 ≤ v < 0.8.2 | 0.7.2, 0.8.2 |
| github.com/prometheus/exporter-toolkitGo | v < 0.7.2, 0.8.0 ≤ v < 0.8.2 | 0.7.2, 0.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.