Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/prometheus/alertmanager

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4GoPublished

    Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

    CVE-2023-40577 · GHSA-v86x-5fm3-5p7j

    Affected
    • Go github.com/prometheus/alertmanager <= 0.25.0
    Fixed in
    0.25.1· Vendor fix available
    Issue
    Impact An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. Patches Users can upgrade to Alertmanager v0.2.51. Workarounds Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint. References N/A

    Recommended action: Upgrade to 0.25.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →