Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1162-1 advisory.

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:2664-1 advisory.

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2675-1 advisory.

  - Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to     bypass a permission check concerning a data source they should not be able to access. (CVE-2021-27962)

  - The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On     Grafana instances using an external authentication service, this vulnerability allows any authenticated     user to add external groups to existing teams. This can be used to grant a user team permissions that the     user isn't supposed to have. (CVE-2021-28146)

  - The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5     has an Incorrect Access Control issue. On Grafana instances using an external authentication service and     having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add     external groups to any existing team. This can be used to grant a user team permissions that the user     isn't supposed to have. (CVE-2021-28147)

  - One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10,     and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to     send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against     a Grafana Enterprise instance. (CVE-2021-28148)

  - Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its     default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due     to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL,     in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be     redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the     /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy     in front of Prometheus. (CVE-2021-29622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Prometheus reports :

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui.
To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.
If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

ID	Name	Product	Family	Severity
152647	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:1162-1)	Nessus	SuSE Local Security Checks	high
152553	openSUSE 15 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2021:2664-1)	Nessus	SuSE Local Security Checks	medium
152552	openSUSE 15 Security Update : SUSE Manager Client Tools (openSUSE-SU-2021:2675-1)	Nessus	SuSE Local Security Checks	high
150091	FreeBSD : Prometheus -- arbitrary redirects (59ab72fb-bccf-11eb-a38d-6805ca1caf5c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-29622

medium

Tenable Plugins

high

medium

high

medium