Description

Prometheus is a monitoring system and time series database

Acunetix determined that it was possible to access Prometheus interface without authentication.

Remediation

Restrict access to Prometheus

References

Security Model

Related Vulnerabilities

GlassFish admin console weak credentials

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.28)

Spring Boot Misconfiguration: Unsafe value for session tracking

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.24)

Symfony Profiler open

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure