--- title: "CX-2019-4297" date: "2019-01-31T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2019-4297/" --- # CX-2019-4297 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2019-3826 **Published:** Jan 31, 2019 CWE-79 CWE-79 6.1 Medium Severity DOMXSS go GoLang XSS DT Dor Tumarkin Reported by Checkmarx Zero Details Overview ## Summary Affected versions of Prometheus are vulnerable to DOM XSS. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts. ## Product Prometheus before version 2.7.1. ## Impact An attacker could run arbitrary Javascript code on a victim. Since this value is stored in LocalStorage, it will persist in the DOM even if the user browses away from the page with the malformed URL, or even if they close and re-open the browser. ## Steps to reproduce 1. Have `enable-query-history` is set to true 2. Navigate to `http://server:9090/graph?g0.range_input=1h&g0.expr=prometheus_target_interval_length_seconds{instance%3D%22localhost%3A9090%22%2Cinterval%3D%2215s%22%2Cjob%3D%22%3Cscript%3Ealert(%27XSS%27)%3C%2Fscript%3E%22%2Cquantile%3D%220.01%22}` 3. Try to type anything that might invoke the history ### Expected result: Alert with `XSS` message will pop up. ## Remediation Updated the Prometheus to 2.7.1 or above. ## Credit This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin. ## Resources 1. [Release note](https://github.com/prometheus/prometheus/releases/v2.7.1) 2. [Pull request](https://github.com/prometheus/prometheus/pull/5163) 3. [b03d6f6](https://github.com/prometheus/prometheus/commit/b03d6f6eff8283bd7cb063edc21041d3fb6c9878) 0 Medium Severity CVSS v3.1 Score 6.1 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)