5.5

CVE-2021-31231

The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Enterprise Metrics Version < 1.2.1
Grafana ≫ Enterprise Metrics SwEditionenterprise Version < 1.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.192
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://community.grafana.com/c/security-announcements
Vendor Advisory
Broken Link
https://grafana.com/docs/metrics-enterprise/
Vendor Advisory
Product
https://grafana.com/docs/metrics-enterprise/latest/downloads/#v113----april-27-2021
Vendor Advisory
Release Notes
https://grafana.com/docs/metrics-enterprise/latest/downloads/#v121----april-27-2021
Vendor Advisory
Release Notes
https://security.netapp.com/advisory/ntap-20210611-0001/
Third Party Advisory