CVE-2021-36157
Summary
| CVE | CVE-2021-36157 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-08-03 15:15:00 UTC |
|---|
| Updated | 2021-08-11 17:23:00 UTC |
|---|
| Description | An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.) |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Release notes | Grafana Labs |
MISC |
grafana.com |
|
| Restrict path segments in TenantIDs (CVE-2021-36157) by simonswine · Pull Request #4375 · cortexproject/cortex · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981231 Go (go) Security Update for github.com/cortexproject/cortex (GHSA-jphm-g89m-v42p)
