CVE-2021-31231

The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when…

published April 30, 2021

CVSS
—
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.2th percentile
Published
2021-04-30T12:34Z
EPSS history
Timeline
  • 30 APR 12:34Z
    The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when…
    cvelistv5