CVE-2021-31232 - CVE House
Back to Database
Status published Medium CVE-2021-31232

The Alertmanager in CNCF Cortex before 1.8.1 has a local...

Vulnerability Description

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-31232

Credits & Attribution

No credits recorded in the NVD database.

References

More from linuxfoundation

View All →
CVE-2022-46770
qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows...
Unknown 0
CVE-2022-46463
An access control issue in Harbor v1.X.X to v2.5.3 allows...
Unknown 0
CVE-2022-45932
A SQL injection issue was discovered in AAA in OpenDaylight...
Unknown 0
CVE-2022-45931
A SQL injection issue was discovered in AAA in OpenDaylight...
Unknown 0
CVE-2022-45930
A SQL injection issue was discovered in AAA in OpenDaylight...
Unknown 0

Affected Vendor

linuxfoundation

View all reports →

Affected Software

cortex
Vulnerable Versions:
0

Timeline

Official Publish: April 30th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.