CVE-2021-31231
Medium
Description
The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Grafana Enterprise Metrics
PublishedApr 30, 2021
First seenApr 30, 2021
How to fix
Update
- grafana enterprise_metrics1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana enterprise_metrics | v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.