CVE-2019-3826GHSA-3M87-5598-2V4F
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
Timeline
- CVE published
- Record last updated
Affected versions
- [UNKNOWN] prometheus
2.7.1
References 8
bugzilla.redhat.com
GitHub · prometheus/prometheus
access.redhat.com
lists.apache.org
- thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@<commits.zookeeper.apache.org>
- thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@<commits.zookeeper.apache.org>
- thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@<commits.zookeeper.apache.org>