Stored DOM-based XSS Vulnerability in Prometheus Server

CVE-2019-3826 · MEDIUM Severity

AV:N/AC:M/AU:N/C:N/I:P/A:N

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

Learn more about our Cis Benchmark Audit For Server Software.