CVE-2021-31231

Katalog CVE

CVSS 5.5 · Medium EPSS 0,28%

Kerentanan pada grafana enterprise metrics. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.

Rincian

Terbit di NVD

30 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://community.grafana.com/c/security-announcements broken link · advisory vendor
• https://grafana.com/docs/metrics-enterprise/ product · advisory vendor
• https://grafana.com/docs/metrics-enterprise/latest/downloads/#v113----april-27-2021 release notes · advisory vendor
• https://grafana.com/docs/metrics-enterprise/latest/downloads/#v121----april-27-2021 release notes · advisory vendor
• https://security.netapp.com/advisory/ntap-20210611-0001/ advisory pihak ketiga