7.5

CVE-2023-40577: Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

Modified
AliasesSUSE-SU-2024:0512-1UBUNTU-CVE-2023-40577USN-6935-1
Published 25-08-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-40577 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 50.4% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.63%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 13
SUSE-SU-2024:0191-1SUSE-SU-2024:0486-1CGA-6V29-M49G-QXFFCGA-7F4H-M585-RHRPCGA-8XWX-H3Q4-G46XCGA-98G2-9G6Q-WPMQ

Timeline

  1. 25-08-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.63%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard4 products
  • prometheus-alertmanager< 0.26.0-r0
  • prometheus-operatorAll versions (No fix recorded)
  • promxy< 0.0.94-r0
  • promxy-fipsAll versions (No fix recorded)
Suse3 products
  • golang-github-prometheus-alertmanager&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 0.26.0-150100.4.19.1
  • golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 15< 0.26.0-150100.4.19.1
  • golang-github-prometheus-alertmanager&distro=SUSE Manager Proxy Module 4.3< 0.26.0-150100.4.19.1
Wolfi3 products
  • prometheus-alertmanager< 0.26.0-r0
  • prometheus-operatorAll versions (No fix recorded)
  • promxy< 0.0.94-r0
Debian2 products
  • prometheus-alertmanager< 0.15.3+ds-3+deb10u1 | All versions (No fix recorded) | < 0.26.0+ds-1
  • debian_linuxEOL10.0
Opensuse2 products
  • golang-github-prometheus-alertmanager&distro=openSUSE Leap 15.5< 0.26.0-150100.4.19.1
  • golang-github-prometheus-alertmanager&distro=openSUSE Tumbleweed< 0.26.0-4.1
Alpine1 product
  • alertmanager< 0.26.0-r0
Github.com/prometheus1 product
  • alertmanager< 0.25.1
Prometheus1 product
Ubuntu1 product
  • prometheus-alertmanager< 0.6.2+ds-3ubuntu0.1+esm1 | < 0.15.3+ds-3ubuntu1.2 | < 0.23.0-4ubuntu0.2+esm1

9 vendors · 18 products

References

13 links
Show all 13 references