5.5
CVE-2021-31231
- EPSS 0.07%
- Veröffentlicht 30.04.2021 13:15:07
- Zuletzt bearbeitet 21.11.2024 06:05:20
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Enterprise Metrics Version < 1.2.1
Grafana ≫ Enterprise Metrics SwEditionenterprise Version < 1.2.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.07% | 0.22 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:L/AC:L/Au:N/C:P/I:N/A:N
|