~ / search / GHSA-3m87-5598-2v4f

GHSA-3m87-5598-2v4f

Withdrawn on 2023-12-18. GitHub withdrew this advisory; it no longer applies.

Withdrawn Advisory: Prometheus XSS Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-3826

Packages

EcosystemPackageAffectedFixed in
Go github.com/prometheus/prometheus < 2.7.1 2.7.1

Details

As written in the advisory (Markdown source, shown as plain text).

## Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references. ## Original Description A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

References

External links from the advisory. They lead to third-party sites.