← Voltar para CVEs

CVE-2023-40577

HIGH

7.5

Descricao

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado8/25/2023

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

debian:debian_linuxprometheus:alertmanager

Fraquezas (CWE)

CWE-79

Referencias

https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j(security-advisories@github.com)

https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html(security-advisories@github.com)

https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.