CVE-2023-40577

🗓️ 25 Aug 2023 00:12:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 3378 Views🌐 WEB

Alertmanager allows execution of arbitrary JavaScript code via POST request

Reporter	Title	Published	Views	Family All 66
AlpineLinux	CVE-2023-40577	25 Aug 202300:12	–	alpinelinux
BDU FSTEC	The vulnerability of the file /api/v1/alerts of the Prometheus monitoring system, which is used to process alerts from Alertmanager, allows a perpetrator to execute arbitrary code.	3 Sep 202400:00	–	bdu_fstec
Chainguard	CVE-2023-40577 vulnerabilities	25 Aug 202301:15	–	cgr
CNNVD	Alertmanager 跨站脚本漏洞	25 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-40577 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint	25 Aug 202300:12	–	cvelist
Debian	[SECURITY] [DLA 3609-1] prometheus-alertmanager security update	8 Oct 202310:14	–	debian
Debian CVE	CVE-2023-40577	25 Aug 202300:12	–	debiancve
Tenable Nessus	Debian dla-3609 : golang-github-prometheus-alertmanager-dev - security update	8 Oct 202300:00	–	nessus
Tenable Nessus	SUSE SLES15 / openSUSE 15 Security Update : golang-github-prometheus-alertmanager (SUSE-SU-2024:0512-1)	17 Feb 202400:00	–	nessus
Tenable Nessus	TencentOS Server 4: alertmanager (TSSA-2024:0822)	16 Jun 202500:00	–	nessus

NVD

Vulners

Node

prometheus alertmanagerMatch0.25.0

Node

debian debian_linuxMatch10.0

[
  {
    "vendor": "prometheus",
    "product": "alertmanager",
    "versions": [
      {
        "version": "<= 0.25.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2023/10/msg00011.html
github	www.github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j

Parameter	Position	Path	Description	CWE
alerts	request body	/api/v1/alerts	Potential XSS via crafted alert payload posted to /api/v1/alerts leading to execution of arbitrary JavaScript in users' browsers.	CWE-79

17 Jun 2026 06:18Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.4 - 7.5

EPSS0.00568

SSVC

CWE-79