{"id":"CVE-2019-3826","aliases":["DEBIAN-CVE-2019-3826","EUVD-2023-3082","GHSA-3m87-5598-2v4f","RHBA-2019:0326","UBUNTU-CVE-2019-3826"],"status":"published","title":"Withdrawn Advisory: Prometheus XSS Vulnerability","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02497,"percentile":0.84801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-03-26T17:48:31Z","modified":"2026-10-24T10:49:54Z","fixes":[{"ecosystem":"Debian:12","package":"prometheus","fixed_in":["2.7.1+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"prometheus","fixed_in":["2.7.1+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"prometheus","fixed_in":["2.7.1+ds-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1+ds-1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog-svcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-cluster-autoscaler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.efb6af0.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-descheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.300.89765c9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.452.0ce6383.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-metrics-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.52.2fdca3f.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node-problem-detector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.254.a448936.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.14.e353758.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.355.5e8b1d9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-openshift-oauth-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.425.7cac034.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.150.2.1549032159-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1549642489-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-playbooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-autoheal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.219.0b5aff4.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.380.cf11c51.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.1+ds-1","1.8.1+ds-2","2.1.0+ds-1"]}],"products":[{"vendor":"[unknown]","product":"prometheus"},{"vendor":"prometheus","product":"prometheus"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3826","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/prometheus/prometheus/pull/5163","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/prometheus/prometheus/commit/62e591f9","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2019-4297","tags":["x_refsource_MISC","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3826","tags":["advisory"]},{"url":"https://github.com/prometheus/prometheus/pull/5163/commits/ea254eea5e3c9a12d6f37a25921b7259ff1c4280","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E","tags":["web"]},{"url":"https://github.com/aquasecurity/trivy/issues/2992","tags":["web"]},{"url":"https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/merge_requests/26608","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3m87-5598-2v4f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3826","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1598822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1615719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1664753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673178","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20102","tags":["advisory"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg32055.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20103","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20615","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3826","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003000","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-08/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669505","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003001","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669508","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003002","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003003","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-16/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003010","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003011","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003012","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670299","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003013","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003014","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2019-3826","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-3826","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"published","published":"2019-03-26T17:48:31Z","modified":"2024-08-04T19:19:18.663Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2023-3082","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"published","published":"2019-03-26T17:48:31Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:06:54.362786Z"}],"ghsa":[{"id":"GHSA-3m87-5598-2v4f","title":"Withdrawn Advisory: Prometheus XSS Vulnerability","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references.\n\n## Original Description\nA stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"withdrawn","published":"2023-12-13T21:26:54Z","modified":"2023-12-18T20:53:31Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:26.727664Z"}],"nvd":[{"id":"CVE-2019-3826","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"published","published":"2019-03-26T18:29:00.623Z","modified":"2026-06-17T02:35:40.203Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-3826","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"published","published":"2019-03-26T18:29:00.623Z","modified":"2026-10-24T10:49:54.302074008Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3826","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"published","published":"2019-03-26T18:29:00.623Z","modified":"2026-09-21T07:03:19.176141862Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-3m87-5598-2v4f","title":"Withdrawn Advisory: Prometheus XSS Vulnerability","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references.\n\n## Original Description\nA stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"withdrawn","published":"2023-12-13T21:26:54Z","modified":"2026-09-10T03:49:59.283940303Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RHBA-2019:0326","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update","status":"published","published":"2024-09-16T02:09:18Z","modified":"2026-08-05T10:05:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2019-3826","description":"A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.","status":"published","published":"2019-03-26T18:29:00Z","modified":"2025-10-24T04:47:26Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"}]}}