Description

Prometheus is a monitoring system and time series database

Acunetix determined that it was possible to access without authentication a web application's metrics exposed for Prometheus.

Remediation

Restrict access to metrics

References

Security Model

Related Vulnerabilities

WebDAV directory listing

WordPress Plugin WP PHP widget Information Disclosure (1.0.2)

WordPress Plugin Image Export Arbitrary File Download (1.1.0)

WordPress Plugin Caldera Forms-More Than Contact Forms Information Disclosure (1.3.5.2)

Laravel debug mode enabled

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure