Описание
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | prometheus | Not affected | ||
| Red Hat OpenShift Container Platform 3.10 | golang-github-prometheus-prometheus | Will not fix | ||
| Red Hat OpenShift Container Platform 3.7 | golang-github-prometheus-prometheus | Will not fix | ||
| Red Hat OpenShift Container Platform 3.9 | golang-github-prometheus-prometheus | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | golang-github-prometheus-prometheus | Not affected | ||
| Red Hat OpenShift Container Platform 3.11 | atomic-enterprise-service-catalog | Fixed | RHBA-2019:0326 | 20.02.2019 |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Fixed | RHBA-2019:0326 | 20.02.2019 |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-cluster-autoscaler | Fixed | RHBA-2019:0326 | 20.02.2019 |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-descheduler | Fixed | RHBA-2019:0326 | 20.02.2019 |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-dockerregistry | Fixed | RHBA-2019:0326 | 20.02.2019 |
Показывать по
Дополнительная информация
Статус:
6.1 Medium
CVSS3
Связанные уязвимости
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prom ...
Withdrawn Advisory: Prometheus XSS Vulnerability
6.1 Medium
CVSS3