A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade prometheus | Feb 14, 2019 | Feb 14, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshift-metrics-serverUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-service-idlerUpgrade openshift-enterprise-autohealUpgrade jenkinsUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-web-consoleUpgrade openshift-ansibleUpgrade atomic-enterprise-service-catalogUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshiftUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-dockerregistryUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-cluster-autoscalerUpgrade haproxy | Mar 15, 2019 | Jan 31, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 26, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub