| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/prometheus/alertmanager | < 0.25.1 | 0.25.1 |
| alertmanager | = 0.25.0 |
An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.
Users can upgrade to Alertmanager v0.2.51.
Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.
N/A
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free