GHSA-939c-3g97-vpvv
Withdrawn Advisory: Access control issues in blackbox_exporter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/prometheus/blackbox_exporter | <= 0.23.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
# Withdrawn Advisory
This advisory has been withdrawn because it was determined to be a configuration issue rather than a vulnerability. This link is maintained to preserve external references. For more information, see the conversation [here](https://github.com/prometheus/blackbox_exporter/issues/1024#issuecomment-1449145854).
# Original Advisory
blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2023-26735
- https://github.com/prometheus/blackbox_exporter/issues/1024
- https://github.com/prometheus/blackbox_exporter/issues/1025
- https://github.com/prometheus/blackbox_exporter/issues/1026
- https://github.com/prometheus/blackbox_exporter
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
- http://blackboxexporter.com
- http://prometheus.com