Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its
    default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due
    to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,
    in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be
    redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the
    /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy
    in front of Prometheus. (CVE-2021-29622)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1162-1 advisory.

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:2664-1 advisory.

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2675-1 advisory.

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Prometheus reports :

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui.
To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.
If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

ID	Name	Product	Family	Severity
255655	Linux Distros Unpatched Vulnerability : CVE-2021-29622	Nessus	Misc.	medium
419593	SCA: security update for github.com/prometheus/prometheus (GHSA-vx57-7f4q-fpc7)	Tenable Cloud Security	SCA Checks	medium
419593	SCA: security update for github.com/prometheus/prometheus (GHSA-vx57-7f4q-fpc7)	Tenable Self-Hosted Container Security	SCA Checks	medium
406581	Alpine: multiple prometheus packages: security update to 2.27.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406581	Alpine: multiple prometheus packages: security update to 2.27.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400215	Alpine: multiple prometheus packages: security update to 2.27.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400215	Alpine: multiple prometheus packages: security update to 2.27.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
152647	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:1162-1)	Nessus	SuSE Local Security Checks	high
152553	openSUSE 15 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2021:2664-1)	Nessus	SuSE Local Security Checks	medium
152552	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:2675-1)	Nessus	SuSE Local Security Checks	high
150091	FreeBSD : Prometheus -- arbitrary redirects (59ab72fb-bccf-11eb-a38d-6805ca1caf5c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-29622

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

high

medium

high

medium