CVE-2019-3826

ADVISORY - github

Summary

Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references.

Original Description

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

EPSS Score: 0.02696 (0.853)

Common Weakness Enumeration (CWE)

ADVISORY - nist

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADVISORY - github

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADVISORY - gitlab

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.

Sign in