{"id":"UBUNTU-CVE-2023-40577","details":"Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.","modified":"2026-01-30T01:35:12.631274Z","published":"2023-08-25T01:15:00Z","related":["USN-6935-1"],"upstream":["CVE-2023-40577"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-40577"},{"type":"REPORT","url":"https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2023-40577"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6935-1"}],"affected":[{"package":{"name":"prometheus-alertmanager","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/prometheus-alertmanager@0.6.2+ds-3ubuntu0.1+esm1?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2+ds-3ubuntu0.1+esm1"}]}],"versions":["0.6.2+ds-2","0.6.2+ds-3","0.6.2+ds-3ubuntu0.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"golang-github-prometheus-alertmanager-dev","binary_version":"0.6.2+ds-3ubuntu0.1+esm1"},{"binary_name":"prometheus-alertmanager","binary_version":"0.6.2+ds-3ubuntu0.1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-40577.json"}},{"package":{"name":"prometheus-alertmanager","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/prometheus-alertmanager@0.15.3+ds-3ubuntu1.2?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.3+ds-3ubuntu1.2"}]}],"versions":["0.15.3+ds-3","0.15.3+ds-3ubuntu1","0.15.3+ds-3ubuntu1.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"golang-github-prometheus-alertmanager-dev","binary_version":"0.15.3+ds-3ubuntu1.2"},{"binary_name":"prometheus-alertmanager","binary_version":"0.15.3+ds-3ubuntu1.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-40577.json"}},{"package":{"name":"prometheus-alertmanager","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/prometheus-alertmanager@0.23.0-4ubuntu0.2+esm1?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-4ubuntu0.2+esm1"}]}],"versions":["0.21.0+ds-4","0.23.0-4","0.23.0-4ubuntu0.1","0.23.0-4ubuntu0.2"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"golang-github-prometheus-alertmanager-dev","binary_version":"0.23.0-4ubuntu0.2+esm1"},{"binary_name":"prometheus-alertmanager","binary_version":"0.23.0-4ubuntu0.2+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-40577.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}