Directory Traversal Vulnerability in Grafana Cortex by Grafana Labs
CVE-2021-36157

5.3MEDIUM

Key Information:

Vendor

Linux
Status
Cortex
Vendor
CVE Published:
3 August 2021

What is CVE-2021-36157?

A directory traversal vulnerability found in Grafana Cortex versions up to 1.9.0 allows attackers to craft malicious X-Scope-OrgID header values. This lets them manipulate file paths, potentially leading to the parsing of rules files from sensitive locations within the deployment. While this could result in unwanted data exposure through error messages, it also opens avenues for further malicious actions via improperly directed API requests.

References

https://grafana.com/docs/grafana/latest/release-notes/
x_refsource_MISC
https://github.com/cortexproject/cortex/pull/4375
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.