high7.5
CVE-2023-40577
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Impact
### Impact An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. ### Patches Users can upgrade to Alertmanager v0.2.51. ### Workarounds Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint. ### References N/A
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/prometheus/alertmanager | <= 0.25.0 | 0.25.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Prometheus | Alertmanager | Version 0.25.0 |
| Debian | Debian Linux | Version 10.0 |