{"id":"CVE-2022-46146","published":"2022-11-29T00:00:00Z","modified":"2024-08-03T14:24:03Z","title":"Prometheus Exporter Toolkit vulnerable to basic authentication bypass","vendor":"prometheus","product":"exporter-toolkit","tier":"tail","description":{"text":"Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.2,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01262,"percentile":0.69583,"provenance":"source"},"cwes":[{"id":"CWE-303","name":"Incorrect Implementation of Authentication Algorithm"},{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p","tags":[]},{"url":"https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/29/1","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/29/2","tags":["mailing-list"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/29/4","tags":["mailing-list"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA/","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202401-15","tags":["vendor-advisory"]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":13.92},{"name":"CVSS severity","points":4.34}]},"vendorSlug":"prometheus","affectedVersions":[{"vendor":"prometheus","product":"exporter-toolkit","versions":["< 0.7.2",">= 0.8.0, < 0.8.2"]}],"affected":[{"ecosystem":"Go","package":"github.com/prometheus/exporter-toolkit","vulnerableRanges":["<0.7.2",">=0.8.0, <0.8.2"],"patched":["0.7.2","0.8.2"],"from":["GHSA-7rg2-cxvp-9p7p","GO-2022-1130"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7555","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-crewjam-saml-cve-2020-27846","parents":[{"from":"CVE-2022-41912","to":"CVE-2022-46146","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-j2jp-wvqg-wc2g","via":"reference","url":"https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p"},{"kind":"osv-related","provenance":"source","id":"GO-2022-1129","via":"reference","url":"https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p"}]}]}}