Back to Database
Status published
High
CVE-2023-40577
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Vulnerability Description
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-40577
Credits & Attribution
No credits recorded in the NVD database.
References
More from prometheus
View All →CVE-2022-46146
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Medium
6.2
CVE-2022-21698
Uncontrolled Resource Consumption in promhttp
High
7.5
CVE-2021-29622
Arbitrary redirects under /new endpoint
Medium
6.5
CVE-2020-16248
Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on...
Medium
5.8
Affected Vendor
prometheus
View all reports →Affected Software
alertmanager
Vulnerable Versions:
<= 0.25.0
Timeline
Official Publish:
August 25th, 2023
Last Modified:
February 13th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N