CVE-2021-29622
Published May 19, 2021
Last updated 3 years ago
Overview
- Description
- Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 6.1
- Impact score
- 2.7
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 5.8
- Impact score
- 4.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
- security-advisories@github.com
- CWE-601
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A93B617-8482-4109-8C83-A06AC85D74F8",
"versionEndExcluding": "2.26.1",
"versionStartIncluding": "2.23.0"
},
{
"criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1E1B501-8DA3-46E7-A4B4-B30A9E2C3335"
},
{
"criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4251CCD-DFC2-4571-8448-319882AAAB08"
}
],
"operator": "OR"
}
]
}
]