VULNERABILITY INTELLIGENCE

CVE-2019-3826

CVSS score6.1 MEDIUM
EPSS probability2.60%
CISA KEVNot currently listed
Published2019-03-26
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

Weakness classification

  • secalert@redhat.com: CWE-79
  • nvd@nist.gov: CWE-79

Primary references