PT-2020-14841 · Prometheus+2 · Prometheus Blackbox Exporter+2

Richard Hartmann · Published 2020-08-09 · Updated 2026-01-30 · CVE-2020-16248

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Prometheus Blackbox Exporter versions through 0.17.0

Description The issue allows for a Server-Side Request Forgery (SSRF) via the /probe endpoint with the target parameter. There is a discussion suggesting this could be seen as both intended functionality and a potential issue.

Recommendations For Prometheus Blackbox Exporter versions through 0.17.0, consider restricting access to the /probe endpoint or limiting the target parameter to minimize the risk of SSRF exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2021-1153

ALT-PU-2022-1254

CLEANSTART-2026-YM28538

CLEANSTART-2026-ZL24388

CVE-2020-16248

ECHO-0FA2-10C0-9888

Affected Products

Alt Linux

Debian

Prometheus Blackbox Exporter

References · 19

• 🔥 https://github.com/prometheus/blackbox_exporter/issues/669 · Exploit
• https://osv.dev/vulnerability/CLEANSTART-2026-YM28538 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16248 · Security Note
• https://prometheus.io/docs/operating/security/#exporters · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-16248 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-16248 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-ZL24388 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-16248 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-16248 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-16248 · Vendor Advisory
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YM28538.json · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZL24388.json · Note
• https://openwall.com/lists/oss-security/2020/08/08/3 · Note
• https://t.me/cvenotify/88989 · Telegram Post