Skip to content
OpenAdvisories
High USN-6935-1 1 CVE

prometheus-alertmanager vulnerability

Published Jul 31, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that prometheus-alertmanager didn't properly sanitize
input it received through an API endpoint. An attacker with permission to
send requests to this endpoint could potentially inject arbitrary code.

On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only
present if the UI has been explicitly activated.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS prometheus-alertmanager 0.15.3+ds-3ubuntu1.2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS prometheus-alertmanager 0.6.2+ds-3ubuntu0.1+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS prometheus-alertmanager 0.23.0-4ubuntu0.2+esm1

Vulnerabilities 1

  • High 7.5
    CVE-2023-40577

    Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

    Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertm…

    prometheus alertmanager prometheus-alertmanager promxy Debian Ubuntu Alpine Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2023-40577