CVE-2023-40577
High
Description
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Prometheus Alertmanager
PublishedAug 25, 2023
First seenAug 25, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- github.com/prometheus/alertmanager0.25.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prometheus alertmanager | 0.25.0 | — |
| debian debian_linux | 10.0 | — |
| github.com/prometheus/alertmanagerGo | v < 0.25.1 | 0.25.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.