Vulnerability-Lookup

CVE-2021-29622 (GCVE-0-2021-29622)

Vulnerability from cvelistv5 – Published: 2021-05-19 20:00 – Updated: 2024-08-03 22:11

Title

Arbitrary redirects under /new endpoint

Summary

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7868 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/prometheus/prometheus/security…	x_refsource_CONFIRM
https://github.com/prometheus/prometheus/releases…	x_refsource_MISC
https://github.com/prometheus/prometheus/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
prometheus	prometheus	Affected: >= 2.23.0, < 2.27.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T22:11:06.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "prometheus",
          "vendor": "prometheus",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.23.0, \u003c 2.27.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-19T20:00:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
        }
      ],
      "source": {
        "advisory": "GHSA-vx57-7f4q-fpc7",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary redirects under /new endpoint",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-29622",
          "STATE": "PUBLIC",
          "TITLE": "Arbitrary redirects under /new endpoint"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "prometheus",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 2.23.0, \u003c 2.27.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "prometheus"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7",
              "refsource": "CONFIRM",
              "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
            },
            {
              "name": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1",
              "refsource": "MISC",
              "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
            },
            {
              "name": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1",
              "refsource": "MISC",
              "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vx57-7f4q-fpc7",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-29622",
    "datePublished": "2021-05-19T20:00:13.000Z",
    "dateReserved": "2021-03-30T00:00:00.000Z",
    "dateUpdated": "2024-08-03T22:11:06.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-29622",
      "date": "2026-11-14",
      "epss": "0.1956",
      "percentile": "0.97424"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2A93B617-8482-4109-8C83-A06AC85D74F8",
                  "versionEndExcluding": "2.26.1",
                  "versionStartIncluding": "2.23.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
                  "matchCriteriaId": "B1E1B501-8DA3-46E7-A4B4-B30A9E2C3335",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*",
                  "matchCriteriaId": "F4251CCD-DFC2-4571-8448-319882AAAB08",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
        },
        {
          "lang": "es",
          "value": "Prometheus es un sistema de monitoreo de c\u00f3digo abierto y una base de datos de series de tiempo.\u0026#xa0;En la versi\u00f3n 2.23.0, Prometheus cambi\u00f3 su Interfaz de Usuario predeterminada a la Nueva interfaz de usuario.\u0026#xa0;Para garantizar una transici\u00f3n sin problemas, la URL con el prefijo /new redirecciona a /.\u0026#xa0;Debido a un bug en el c\u00f3digo, es posible para un atacante dise\u00f1ar una URL que pueda redireccionar a cualquier otra URL, en el endpoint /new.\u0026#xa0;Si un usuario visita un servidor de Prometheus con una direcci\u00f3n especialmente dise\u00f1ada, ellos pueden ser redirigidos a una URL arbitraria.\u0026#xa0;El problema fue parcheado en las versiones 2.26.1 y 2.27.1.\u0026#xa0;En la versi\u00f3n 2.28.0, el endpoint /new ser\u00e1 eliminado completamente.\u0026#xa0;La soluci\u00f3n es deshabilitar un acceso a /new por medio de un proxy inverso en frente de Prometheus"
        }
      ],
      "id": "CVE-2021-29622",
      "lastModified": "2024-11-21T06:01:30.877",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 5.8,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 4.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-05-19T20:15:07.487",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-601"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A93B617-8482-4109-8C83-A06AC85D74F8",
                    "versionEndExcluding": "2.26.1",
                    "versionStartIncluding": "2.23.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "B1E1B501-8DA3-46E7-A4B4-B30A9E2C3335",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*",
                    "matchCriteriaId": "F4251CCD-DFC2-4571-8448-319882AAAB08",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
          },
          {
            "lang": "es",
            "value": "Prometheus es un sistema de monitoreo de c\u00f3digo abierto y una base de datos de series de tiempo.\u0026#xa0;En la versi\u00f3n 2.23.0, Prometheus cambi\u00f3 su Interfaz de Usuario predeterminada a la Nueva interfaz de usuario.\u0026#xa0;Para garantizar una transici\u00f3n sin problemas, la URL con el prefijo /new redirecciona a /.\u0026#xa0;Debido a un bug en el c\u00f3digo, es posible para un atacante dise\u00f1ar una URL que pueda redireccionar a cualquier otra URL, en el endpoint /new.\u0026#xa0;Si un usuario visita un servidor de Prometheus con una direcci\u00f3n especialmente dise\u00f1ada, ellos pueden ser redirigidos a una URL arbitraria.\u0026#xa0;El problema fue parcheado en las versiones 2.26.1 y 2.27.1.\u0026#xa0;En la versi\u00f3n 2.28.0, el endpoint /new ser\u00e1 eliminado completamente.\u0026#xa0;La soluci\u00f3n es deshabilitar un acceso a /new por medio de un proxy inverso en frente de Prometheus"
          }
        ],
        "id": "CVE-2021-29622",
        "lastModified": "2024-11-21T06:01:30.877",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 4.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-05-19T20:15:07.487",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T07:00:55+00:00",
      "cve": "CVE-2021-29622",
      "id": "CVE-2021-29622",
      "initial_release_date": "2021-05-18T00:00:00+00:00",
      "product_status:fixed": "3",
      "product_status:known_not_affected": "387",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "prometheus: open redirect under the /new endpoint",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-29622.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T01:05:26Z",
      "cve": "CVE-2021-29622",
      "id": "CVE-2021-29622",
      "initial_release_date": "2023-02-15T03:42:50Z",
      "product_status:recommended": "243",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-29622",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-29622.json",
      "version": "24"
    }
  }
}

bit-prometheus-2021-29622

Vulnerability from bitnami_vulndb

Published

2024-03-06 11:02

Modified

2026-09-08 08:34

Summary

Arbitrary redirects under /new endpoint

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "prometheus",
        "purl": "pkg:bitnami/prometheus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.23.0"
            },
            {
              "fixed": "2.26.1"
            },
            {
              "introduced": "2.27.0"
            },
            {
              "fixed": "2.27.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-29622"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.",
  "id": "BIT-prometheus-2021-29622",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T11:02:27.773Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29622"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Arbitrary redirects under /new endpoint"
}

CLEANSTART-2026-JD89615 (CVE-2021-29622)

Vulnerability from cleanstart – Published: 2026-09-18 10:33 – Updated: 2026-10-08 19:54 – Source website

Summary

Security fix for CVE-2021-29622 applied in: prometheus 2.27.1-r0, prometheus-fips 2.27.1-r0

Details

CVE-2021-29622 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2021-29622	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2021-29622	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "prometheus",
        "purl": "pkg:apk/cleanstart/prometheus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.27.1-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "prometheus-fips",
        "purl": "pkg:apk/cleanstart/prometheus-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.27.1-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "CVE-2021-29622 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-JD89615",
  "modified": "2026-10-08T19:54:55Z",
  "published": "2026-09-18T10:33:03.175955Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JD89615.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2021-29622"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29622"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Security fix for CVE-2021-29622 applied in: prometheus 2.27.1-r0, prometheus-fips 2.27.1-r0",
  "upstream": [
    "CVE-2021-29622"
  ]
}

CLEANSTART-2026-NT47758 (CVE-2021-29622)

Vulnerability from cleanstart – Published: 2026-07-30 07:10 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in prometheus 2.27.1-r0

Details

Package prometheus version 2.27.1-r0 fixes 1 vulnerabilities: CVE-2021-29622

References

URL

Type

https://github.com/prometheus/prometheus

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "prometheus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.27.1-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.27.1-r0"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package prometheus version 2.27.1-r0 fixes 1 vulnerabilities: CVE-2021-29622",
  "id": "CLEANSTART-2026-NT47758",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/prometheus/prometheus"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in prometheus 2.27.1-r0",
  "upstream": [
    "CVE-2021-29622"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2021-29622

Vulnerability from fkie_nvd - Published: 2021-05-19 20:15 - Updated: 2026-06-17 03:48

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/prometheus/prometheus/releases/tag/v2.26.1	Third Party Advisory
security-advisories@github.com	https://github.com/prometheus/prometheus/releases/tag/v2.27.1	Third Party Advisory
security-advisories@github.com	https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/prometheus/prometheus/releases/tag/v2.26.1	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/prometheus/prometheus/releases/tag/v2.27.1	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7	Third Party Advisory

Impacted products

Vendor	Product	Version
prometheus	prometheus	*
prometheus	prometheus	2.27.0
prometheus	prometheus	2.27.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "prometheus",
          "vendor": "prometheus",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.23.0, \u003c 2.27.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A93B617-8482-4109-8C83-A06AC85D74F8",
              "versionEndExcluding": "2.26.1",
              "versionStartIncluding": "2.23.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "B1E1B501-8DA3-46E7-A4B4-B30A9E2C3335",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*",
              "matchCriteriaId": "F4251CCD-DFC2-4571-8448-319882AAAB08",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
    },
    {
      "lang": "es",
      "value": "Prometheus es un sistema de monitoreo de c\u00f3digo abierto y una base de datos de series de tiempo.\u0026#xa0;En la versi\u00f3n 2.23.0, Prometheus cambi\u00f3 su Interfaz de Usuario predeterminada a la Nueva interfaz de usuario.\u0026#xa0;Para garantizar una transici\u00f3n sin problemas, la URL con el prefijo /new redirecciona a /.\u0026#xa0;Debido a un bug en el c\u00f3digo, es posible para un atacante dise\u00f1ar una URL que pueda redireccionar a cualquier otra URL, en el endpoint /new.\u0026#xa0;Si un usuario visita un servidor de Prometheus con una direcci\u00f3n especialmente dise\u00f1ada, ellos pueden ser redirigidos a una URL arbitraria.\u0026#xa0;El problema fue parcheado en las versiones 2.26.1 y 2.27.1.\u0026#xa0;En la versi\u00f3n 2.28.0, el endpoint /new ser\u00e1 eliminado completamente.\u0026#xa0;La soluci\u00f3n es deshabilitar un acceso a /new por medio de un proxy inverso en frente de Prometheus"
    }
  ],
  "id": "CVE-2021-29622",
  "lastModified": "2026-06-17T03:48:02.743",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-05-19T20:15:07.487",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VX57-7F4Q-FPC7

Vulnerability from github – Published: 2022-02-15 01:57 – Updated: 2021-05-28 22:05

Summary

Arbitrary redirects under /new endpoint

Details

Impact

In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.

If a user visits a prometheus server with a specially crafted address (e.g.: http://127.0.0.1:9090/new/new<url>), they can be redirected to an arbitrary URL.

e.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com.

Patches

The issue will be patched in 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely.

Workarounds

The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Note: Users who use a --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus) are not affected.

For more information

If you have any questions or comments about this advisory, please use our community channels (https://prometheus.io/community). Our security policy is available at https://prometheus.io/docs/operating/security/

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/prometheus/prometheus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.23.0"
            },
            {
              "fixed": "2.26.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/prometheus/prometheus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.27.0"
            },
            {
              "fixed": "2.27.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.27.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-29622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-19T17:58:51Z",
    "nvd_published_at": "2021-05-19T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIn 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /.\nDue to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.\n\nIf a user visits a prometheus server with a specially crafted address (e.g.: `http://127.0.0.1:9090/new/new\u003curl\u003e`), they can be redirected to an arbitrary URL.\n\ne.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com.\n\n### Patches\n\nThe issue will be patched in 2.26.1 and 2.27.1 releases.\nIn 2.28.0, the /new endpoint will be removed completely.\n\n### Workarounds\n\nThe workaround is to disable access to /new via a reverse proxy in front of Prometheus.\n\nNote: Users who use a `--web.external-url=` flag _with a path_ (e.g.  `--web.external-url=http://example.com/prometheus`) are not affected.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please use our community channels (https://prometheus.io/community).\nOur security policy is available at https://prometheus.io/docs/operating/security/\n",
  "id": "GHSA-vx57-7f4q-fpc7",
  "modified": "2021-05-28T22:05:12Z",
  "published": "2022-02-15T01:57:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29622"
    },
    {
      "type": "WEB",
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arbitrary redirects under /new endpoint"
}

GSD-2021-29622

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-29622

Aliases

CVE-2021-29622

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-29622",
    "description": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.",
    "id": "GSD-2021-29622",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-29622.html",
      "https://access.redhat.com/errata/RHSA-2021:2438",
      "https://security.archlinux.org/CVE-2021-29622"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-29622"
      ],
      "details": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.",
      "id": "GSD-2021-29622",
      "modified": "2023-12-13T01:23:36.560303Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-29622",
        "STATE": "PUBLIC",
        "TITLE": "Arbitrary redirects under /new endpoint"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "prometheus",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 2.23.0, \u003c 2.27.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "prometheus"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7",
            "refsource": "CONFIRM",
            "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
          },
          {
            "name": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1",
            "refsource": "MISC",
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
          },
          {
            "name": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1",
            "refsource": "MISC",
            "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-vx57-7f4q-fpc7",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.23.0 \u003c2.26.1||=2.27.0",
          "affected_versions": "All versions starting from 2.23.0 before 2.26.1, version 2.27.0",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-04-12",
          "description": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.",
          "fixed_versions": [
            "2.26.1",
            "2.27.1"
          ],
          "identifier": "CVE-2021-29622",
          "identifiers": [
            "GHSA-vx57-7f4q-fpc7",
            "CVE-2021-29622"
          ],
          "not_impacted": "All versions before 2.23.0, all versions starting from 2.26.1 before 2.27.0, all versions after 2.27.0",
          "package_slug": "go/github.com/prometheus/prometheus",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to versions 2.26.1, 2.27.1 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-29622",
            "https://github.com/prometheus/prometheus/releases/tag/v2.26.1",
            "https://github.com/prometheus/prometheus/releases/tag/v2.27.1",
            "https://github.com/advisories/GHSA-vx57-7f4q-fpc7"
          ],
          "uuid": "532f09b0-7ee3-42e9-b766-7d6bd0b5f561"
        },
        {
          "affected_range": "\u003e=v2.23.0 \u003cv2.26.1 || =v2.27.0",
          "affected_versions": "All versions starting from 2.23.0 before 2.26.1, version 2.27.0",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2021-05-26",
          "description": "Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the `/new` endpoint.",
          "fixed_versions": [],
          "identifier": "CVE-2021-29622",
          "identifiers": [
            "CVE-2021-29622",
            "GHSA-vx57-7f4q-fpc7"
          ],
          "not_impacted": "",
          "package_slug": "go/github.com/prometheus/prometheus/web/ui",
          "pubdate": "2021-05-19",
          "solution": "Unfortunately, there is no solution available yet.",
          "title": "URL Redirection to Untrusted Site (Open Redirect)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-29622"
          ],
          "uuid": "4a7eb152-d366-4a32-a80d-7936f0abd07b",
          "versions": [
            {
              "commit": {
                "sha": "2447c56ec7835da037c6dff4c3f6094c03692f16",
                "tags": [
                  "v2.23.0"
                ],
                "timestamp": "20201126101154"
              },
              "number": "v2.23.0"
            },
            {
              "commit": {
                "sha": "2c266fff772d180d527db10b04c08c85b2508014",
                "tags": [
                  "v2.27.0"
                ],
                "timestamp": "20210512173212"
              },
              "number": "v2.27.0"
            },
            {
              "commit": {
                "sha": "0cf098df8f7d50f13d8e2c2b080ba1a1acd37236",
                "tags": [
                  "v2.26.1"
                ],
                "timestamp": "20210518124745"
              },
              "number": "v2.26.1"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.26.1",
                "versionStartIncluding": "2.23.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-29622"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL\u0027s prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7"
            },
            {
              "name": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1"
            },
            {
              "name": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2021-05-26T22:29Z",
      "publishedDate": "2021-05-19T20:15Z"
    }
  }
}

MSRC_CVE-2021-29622

Vulnerability from csaf_microsoft - Published: 2021-05-02 00:00 - Updated: 2021-12-16 00:00

Summary

Arbitrary redirects under /new endpoint

Scope

1 vulnerability in this advisory, including CVE-2021-29622.

CVE-2021-29622

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fixed: 1 product Known affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OPENSUSE-SU-2021:1162-1

Vulnerability from csaf_opensuse - Published: 2021-08-17 10:06 - Updated: 2026-09-20 19:28

Summary

Security update for SUSE Manager Client Tools

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2021-29622.

CVE-2021-29622

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Recommended: 5 products

Open the full advisory

OPENSUSE-SU-2021:2664-1

Vulnerability from csaf_opensuse - Published: 2021-08-12 10:02 - Updated: 2026-09-20 19:33

Summary

Security update for golang-github-prometheus-prometheus

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2021-29622.

CVE-2021-29622

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Recommended: 4 products

Open the full advisory

OPENSUSE-SU-2021:2675-1

Vulnerability from csaf_opensuse - Published: 2021-08-12 10:05 - Updated: 2026-09-20 19:33

Summary

Security update for SUSE Manager Client Tools

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2021-29622.

CVE-2021-29622

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Recommended: 62 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-29622 (GCVE-0-2021-29622)

Vulnerability from bitnami_vulndb

CLEANSTART-2026-JD89615 (CVE-2021-29622)

CLEANSTART-2026-NT47758 (CVE-2021-29622)

Impact

Patches

Workarounds

For more information

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour