CVE-2023-40577

SOURCE - github

Summary

Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

Patches

Users can upgrade to Alertmanager v0.2.51.

Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

References

N/A

EPSS Score⁠: 0.00049 (0.189)

Common Weakness Enumeration (CWE)

SOURCE - nist

CWE-79⁠

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SOURCE - github

CWE-79⁠

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

SOURCE - redhat

CWE-79⁠

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources (16)

Impacted images

NIST

CREATED

1 year ago

UPDATED

11 months ago

SOURCE IDCVE-2023-40577⁠

EXPLOITABILITY SCORE

2.3

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-79⁠

CVSS SCORE

5.4medium

GitHub

CREATED

1 year ago

UPDATED

1 year ago

SOURCE IDGHSA-v86x-5fm3-5p7j⁠

EXPLOITABILITY SCORE

2.3

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-79⁠

CVSS SCORE

5.4medium

Alpine

CREATED

1 year ago

UPDATED

3 months ago

SOURCE IDCVE-2023-40577⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Debian

CREATED

1 year ago

UPDATED

2 months ago

SOURCE IDCVE-2023-40577⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Ubuntu

CREATED

1 year ago

UPDATED

1 month ago

SOURCE IDCVE-2023-40577⁠

EXPLOITABILITY SCORE

2.3

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

5.4medium

GoLang

CREATED

17 days ago

UPDATED

17 days ago

SOURCE IDGO-2023-2020⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Red Hat

CREATED

1 year ago

UPDATED

10 months ago

SOURCE IDCVE-2023-40577⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-79⁠

CVSS SCORE

7.5medium

Chainguard

CREATED

1 year ago

UPDATED

1 year ago

SOURCE ID

CGA-qrgj-wj7v-r5x2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

11 months ago

UPDATED

11 months ago

SOURCE ID

CGA-wch8-gq8v-g3r5

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

1 year ago

UPDATED

1 year ago

SOURCE ID

CGA-7f4h-m585-rhrp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

1 year ago

UPDATED

1 year ago

SOURCE ID

CGA-8xwx-h3q4-g46x

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

3 months ago

UPDATED

3 months ago

SOURCE ID

CGA-98g2-9g6q-wpmq

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

1 year ago

UPDATED

1 year ago

SOURCE ID

CGA-cp98-m225-5r8c

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

1 year ago

UPDATED

1 year ago

SOURCE ID

CGA-fm97-7fqm-gp74

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

1 year ago

UPDATED

1 year ago

SOURCE ID

CGA-gjg2-34xh-wgjg

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE

Chainguard

CREATED

6 months ago

UPDATED

6 months ago

SOURCE ID

CGA-jm99-fpwg-pwq5

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM SOURCE