What is GHSA-v86x-5fm3-5p7j?

GHSA-v86x-5fm3-5p7j is a security advisory published by GitHub Security Advisories with Medium severity. Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

Which CVE IDs does GHSA-v86x-5fm3-5p7j cover?

GHSA-v86x-5fm3-5p7j covers the following CVE IDs: CVE-2023-40577. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v86x-5fm3-5p7j?

GHSA-v86x-5fm3-5p7j has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-v86x-5fm3-5p7j?

GHSA-v86x-5fm3-5p7j affects 1 product, including: go/github.com/prometheus/alertmanager:\u003c= 0.25.0.

GHSA-v86x-5fm3-5p7jMediumCVSS 5.4

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

Vendor

GitHub Security Advisories

Published

August 23, 2023

Last Modified

November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-40577 →

📋 Description

Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

Patches

Users can upgrade to Alertmanager v0.2.51.

Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

References

N/A

🎯 Affected products1

go/github.com/prometheus/alertmanager:<= 0.25.0

🔗 References (4)

https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j
https://nvd.nist.gov/vuln/detail/CVE-2023-40577
https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html
https://github.com/advisories/GHSA-v86x-5fm3-5p7j