‹ Back to list

CVE-2021-29622

Status: ModifiedMedium (6.1)—Exploit
Severity6.1Medium · CVSS 3.1
Exploitation probability20 %higher than 97% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitAvailableNuclei template (automated mass detection)

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

CVSS

Base score
6.1
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
20 %
Percentile among all scored CVEs
97
Score date
10/27/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Affected technologies (1)

Prometheus — Prometheus

CWEs

References

Show 6 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2021-29622",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "prometheus",
          "product": "prometheus",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.23.0, < 2.27.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-19T20:15:07.487",
  "references": [
    {
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.26.1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/prometheus/prometheus/releases/tag/v2.27.1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus."
    },
    {
      "lang": "es",
      "value": "Prometheus es un sistema de monitoreo de código abierto y una base de datos de series de tiempo.&#xa0;En la versión 2.23.0, Prometheus cambió su Interfaz de Usuario predeterminada a la Nueva interfaz de usuario.&#xa0;Para garantizar una transición sin problemas, la URL con el prefijo /new redirecciona a /.&#xa0;Debido a un bug en el código, es posible para un atacante diseñar una URL que pueda redireccionar a cualquier otra URL, en el endpoint /new.&#xa0;Si un usuario visita un servidor de Prometheus con una dirección especialmente diseñada, ellos pueden ser redirigidos a una URL arbitraria.&#xa0;El problema fue parcheado en las versiones 2.26.1 y 2.27.1.&#xa0;En la versión 2.28.0, el endpoint /new será eliminado completamente.&#xa0;La solución es deshabilitar un acceso a /new por medio de un proxy inverso en frente de Prometheus"
    }
  ],
  "lastModified": "2026-06-17T03:48:02.743",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A93B617-8482-4109-8C83-A06AC85D74F8",
              "versionEndExcluding": "2.26.1",
              "versionStartIncluding": "2.23.0"
            },
            {
              "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1E1B501-8DA3-46E7-A4B4-B30A9E2C3335"
            },
            {
              "criteria": "cpe:2.3:a:prometheus:prometheus:2.27.0:rc0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4251CCD-DFC2-4571-8448-319882AAAB08"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}