Lucene search
GoogleOSV:GO-2022-1130HistoryNov 29, 2022 - 4:33 p.m.
Authentication bypass in github.com/prometheus/exporter-toolkit
2022-11-2916:33:47
Google
osv.dev
41
prometheus
authentication bypass
web.yml
bcrypted passwords
security
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.7
Confidence
High
EPSS
0.012
Percentile
85.4%
If an attacker has access to a Prometheus web.yml file and users’ bcrypted passwords, it would be possible to bypass security via the built-in authentication cache.
Related
nessus
nessus
fedora
fedora
[SECURITY] Fedora 37 Update: golang-github-xhit-str2duration-2.1.0-3.fc37
2023-09-21 01:22:17
[SECURITY] Fedora 39 Update: golang-github-prometheus-exporter-toolkit-0.10.0-1.fc39
2023-09-20 00:20:43
[SECURITY] Fedora 39 Update: golang-github-xhit-str2duration-2.1.0-3.fc39
2023-09-20 00:20:44
prion
prion
Design/Logic Flaw
2022-11-29 14:15:00
osv
osv
Prometheus Exporter-Toolkit is vulnerable to authentication bypass
2022-12-02 22:25:46
prometheus-postgres_exporter-0.10.1-2.1 on GA media
2024-06-15 00:00:00
CGA-7pp4-6ggr-m3vr
2024-06-06 12:25:00
cvelist
cvelist
cgr
cgr
CVE-2022-46146 vulnerabilities
2024-05-19 03:07:16
openvas
openvas
gentoo
gentoo
Prometheus SNMP Exporter: Basic Authentication Bypass
2024-01-12 00:00:00
redhatcve
redhatcve
CVE-2022-46146
2022-11-29 21:56:18
alpinelinux
alpinelinux
CVE-2022-46146
2022-11-29 14:15:13
cve
cve
CVE-2022-46146
2022-11-29 14:15:13
nvd
nvd
CVE-2022-46146
2022-11-29 14:15:13
debiancve
debiancve
CVE-2022-46146
2022-11-29 14:15:13
ubuntucve
ubuntucve
CVE-2022-46146
2022-11-29 00:00:00
cnvd
cnvd
Unspecified vulnerability in prometheus exporter_toolkit
2022-12-01 00:00:00
veracode
veracode
Authentication Bypass
2022-11-30 03:28:11
cbl_mariner
cbl_mariner
redos
redos
ROS-20240806-13
2024-08-06 00:00:00
freebsd
freebsd
prometheus2 -- basic authentication bypass
2022-11-28 00:00:00
node_exporter -- bypass security with cache poisoning
2021-11-28 00:00:00
github
github
Prometheus Exporter-Toolkit is vulnerable to authentication bypass
2022-12-02 22:25:46
redhat
redhat
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
8.7
Confidence
High
EPSS
0.012
Percentile
85.4%
Related for OSV:GO-2022-1130