A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

An update of the telegraf package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An     attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus     server, allowing for the execution and persistent storage of arbitrary scripts. (CVE-2019-3826)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An
    attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus
    server, allowing for the execution and persistent storage of arbitrary scripts. (CVE-2019-3826)

ID	Name	Product	Family	Type	Severity
333780	Photon OS 5.0: Telegraf PHSA-2023-5.0-91-0041	Nessus	PhotonOS Local Security Checks	Local	high
258889	Linux Distros Unpatched Vulnerability : CVE-2019-3826	Nessus	Misc.	Local	medium
409588	SCA: security update for github.com/prometheus/prometheus (GHSA-3m87-5598-2v4f)	Tenable Cloud Security	SCA Checks	Local	medium
409588	SCA: security update for github.com/prometheus/prometheus (GHSA-3m87-5598-2v4f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
204453	Photon OS 4.0: Telegraf PHSA-2023-4.0-0428	Nessus	PhotonOS Local Security Checks	Local	high
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	Local	high
204094	Photon OS 3.0: Telegraf PHSA-2023-3.0-0615	Nessus	PhotonOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-3826

medium

Tenable Plugins

high

medium

medium

medium

high

high

medium