Description

Prometheus is a monitoring system and time series database

Acunetix determined that it was possible to access without authentication a web application's metrics exposed for Prometheus.

Remediation

Restrict access to metrics

References

Security Model

Related Vulnerabilities

Unchecked GraphQL Query Length: Potential Denial of Service Vulnerability

WordPress Plugin WebP Express Arbitrary File Disclosure (0.14.10)

WordPress Plugin Doneren met Mollie Information Disclosure (2.8.4)

Overly long session timeout in servlet configuration

Incorrect Content Security Policy (CSP) Implementation

Severity

Low

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Configuration Information Disclosure CWE-200