modules:
  - module: github.com/prometheus/exporter-toolkit
    versions:
      - fixed: 0.7.2
      - introduced: 0.8.0
        fixed: 0.8.2
    vulnerable_at: 0.8.1
    packages:
      - package: github.com/prometheus/exporter-toolkit/web
        symbols:
          - webHandler.ServeHTTP
        derived_symbols:
          - Listen
          - ListenAndServe
          - Serve
          - ServeMultiple
description: |
    If an attacker has access to a Prometheus web.yml file and users' bcrypted
    passwords, it would be possible to bypass security via the built-in
    authentication cache.
cves:
  - CVE-2022-46146
ghsas:
  - GHSA-7rg2-cxvp-9p7p
credit: Lei Wan
references:
  - advisory: https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
  - fix: https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5