Vulnerability Description
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Prometheus | Exporter Toolkit | < 0.7.2 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2022/11/29/1ExploitMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/29/2ExploitMailing ListPatch
- http://www.openwall.com/lists/oss-security/2022/11/29/4ExploitMailing ListPatch
- https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736PatchThird Party Advisory
- https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202401-15
- http://www.openwall.com/lists/oss-security/2022/11/29/1ExploitMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2022/11/29/2ExploitMailing ListPatch
- http://www.openwall.com/lists/oss-security/2022/11/29/4ExploitMailing ListPatch
- https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736PatchThird Party Advisory
- https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2022-46146?
CVE-2022-46146 is a vulnerability with a CVSS score of 6.2 (MEDIUM). Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypas...
How severe is CVE-2022-46146?
CVE-2022-46146 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-46146?
Check the references section above for vendor advisories and patch information. Affected products include: Prometheus Exporter Toolkit.