A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/prometheus/prometheus(Go) | 0 | 2.7.1 | N/A |
CVSS Metrics
