CVE-2023-40577 Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
An attacker with POST permissions can inject malicious JavaScript into Alertmanager, leading to arbitrary code execution in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40577?
CVE-2023-40577 is a high-severity cross-site scripting vulnerability in Debian Debian Linux, published on 25 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
Weakness: CWE-79
Which versions are affected by CVE-2023-40577?
4 open source packages ship an affected version, including github.com/prometheus/alertmanager and alertmanager. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/prometheus/alertmanager Go | All versions | 0.25.1 |
github.com/prometheus/alertmanager Go | All versions | 0.25.1 |
github.com/prometheus/alertmanager Go | All versions | 0.25.1 |
alertmanager Bitnami | From 0.25.0 | 0.25.1 |
Linux distribution packages (5)
golang-github-prometheus-alertmanager SUSE:Linux Enterprise Module for Package Hub 15 SP5 | All versions | 0.26.0-150100.4.19.1 |
golang-github-prometheus-alertmanager SUSE:Manager Client Tools 15 | All versions | 0.26.0-150100.4.19.1 |
golang-github-prometheus-alertmanager SUSE:Manager Proxy Module 4.3 | All versions | 0.26.0-150100.4.19.1 |
golang-github-prometheus-alertmanager openSUSE:Leap 15.5 | All versions | 0.26.0-150100.4.19.1 |
golang-github-prometheus-alertmanager openSUSE:Tumbleweed | All versions | 0.26.0-4.1 |
Products include Debian Debian Linux, Prometheus Alertmanager.
How do I fix CVE-2023-40577?
Upgrade github.com/prometheus/alertmanager to 0.25.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-40577 being exploited?
There is no known exploitation of CVE-2023-40577 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-alertmanager-2023-40577, CLEANSTART-2025-UV88153, CLEANSTART-2026-IS77725, CLEANSTART-2026-RH44885, DEBIAN-CVE-2023-40577, DLA-3609-1 and 6 more.