Prometheus 2.27.0
Approved changes feed: RSS · Atom
cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*
part: a version: 2.27.0 update: -
| Vendor | Prometheus (ce7075df-ff22-5cad-855b-357b513f2cea) |
|---|---|
| Product | Prometheus (ea12f5a1-22e9-55d0-b72d-feffe52243d4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/prometheus |
purl2cpe | 2026-06-01 10:11:49.883058 |
pkg:deb/ubuntu/prometheus |
purl2cpe | 2026-06-01 10:11:49.883059 |
pkg:github/prometheus/prometheus |
purl2cpe | 2026-06-01 10:11:49.883060 |
pkg:rpm/fedora/golang-github-prometheus |
purl2cpe | 2026-06-01 10:11:49.883062 |
pkg:sourceforge/prometheus.mirror |
purl2cpe | 2026-06-01 10:11:49.883063 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-29622 |
vulnerable | 2026-06-08 05:31:26.595084 |
Arbitrary redirects under /new endpoint
MEDIUM (6.5)
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
Published: 2021-05-19T20:00:13.000Z
Updated: 2024-08-03T22:11:06.291Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.