CVE-2021-31232

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used

published April 30, 2021

CVSS
—
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.8th percentile
Published
2021-04-30T12:46Z
EPSS history
Timeline
  • 30 APR 12:46Z
    The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used
    cvelistv5