Skip to content
OpenAdvisories
High DLA-3609-1 1 CVE

prometheus-alertmanager - security update

Published Oct 8, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 prometheus-alertmanager 0.15.3+ds-3+deb10u1

Vulnerabilities 1

  • High 7.5
    CVE-2023-40577

    Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

    Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertm…

    prometheus alertmanager prometheus-alertmanager promxy Debian Ubuntu Alpine Wolfi Go