high7.5
CVE-2023-26735
Withdrawn Advisory: Access control issues in blackbox_exporter
Impact
# Withdrawn Advisory This advisory has been withdrawn because it was determined to be a configuration issue rather than a vulnerability. This link is maintained to preserve external references. For more information, see the conversation [here](https://github.com/prometheus/blackbox_exporter/issues/1024#issuecomment-1449145854). # Original Advisory blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/prometheus/blackbox_exporter | <= 0.23.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Prometheus | Blackbox Exporter | Version 0.23.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
- https://github.com/prometheus/blackbox_exporter/issues/1024
- https://github.com/prometheus/blackbox_exporter/issues/1025
- https://github.com/prometheus/blackbox_exporter/issues/1026
- https://github.com/advisories/GHSA-939c-3g97-vpvv
- https://nvd.nist.gov/vuln/detail/CVE-2023-26735
- http://blackboxexporter.com
- http://prometheus.com