5.5

CVE-2021-31232

EPSS 0.09%
Veröffentlicht 30.04.2021 13:15:07
Zuletzt bearbeitet 21.11.2024 06:05:21
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linuxfoundation ≫ Cortex Version < 1.8.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.09%	0.232

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:P/I:N/A:N

https://community.grafana.com/c/security-announcements

Third Party Advisory

https://github.com/cortexproject/cortex

Third Party Advisory

https://github.com/cortexproject/cortex/pull/4129/files

Patch

Third Party Advisory

https://lists.cncf.io/g/cortex-users/message/50

Vendor Advisory

Release Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-31232

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-31232

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-31232

EUVD