| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/prometheus/prometheus | < 2.7.1 | 2.7.1 |
| prometheus | < 2.7.1 | 2.7.1 |
| openshift container platform | = 3.11 |
This advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references.
A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free