CVE-2020-16248

MEDIUM NUCLEI

Prometheus Blackbox Exporter < 0.17.0 - Server-Side Request Forgery via Probe Target Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-16248 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this might plausibly be interpreted as both intended functionality and also a vulnerability

Nuclei Templates (1)

Prometheus Blackbox Exporter - Server-Side Request Forgery (SSRF)
MEDIUMVERIFIEDby DhiyaneshDk
Shodan: title:"Blackbox Exporter"
FOFA: title="Blackbox Exporter"

References (5)

Core 5
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/prometheus/blackbox_exporter/issues/669
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2020/08/08/3
Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2020/08/08/12
Mailing List, Third Party Advisory x_refsource_misc
https://seclists.org/oss-sec/2020/q3/94

Scores

CVSS v3 5.8
EPSS 0.0272
EPSS Percentile 84.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Details

CWE
CWE-918
Status published
Products (1)
prometheus/blackbox_exporter < 0.17.0
Published Aug 09, 2020
Tracked Since Feb 18, 2026