CVE-2021-31232
Medium
Description
The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
SeverityMedium
CVSS5.5
Exploit probability—
ProductLinuxfoundation Cortex
PublishedApr 30, 2021
First seenApr 30, 2021
How to fix
Update
- linuxfoundation cortex1.8.1 or later
- github.com/cortexproject/cortex1.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation cortex | v < 1.8.1 | 1.8.1 |
| github.com/cortexproject/cortexGo | v < 1.8.1 | 1.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.