Skip to content
OpenAdvisories

Package · Go

github.com/cortexproject/cortex

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2024-41265

    cortex establishes TLS connections with `InsecureSkipVerify` set to `true`

    A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.

    github.com/cortexproject/cortex github.com/cortexlabs/cortex Go
  • Medium 6.5
    CVE-2022-23536

    Alertmanager can expose local files content via specially crafted config

    Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertm…

    cortexproject cortex github.com/cortexproject/cortex Go
  • Medium —
    CVE-2021-36157

    Path traversal in Grafana Cortex

    An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will att…

    github.com/cortexproject/cortex Go
  • Medium 5.5
    CVE-2021-31232

    Improper input validation in CNCF Cortex

    The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanag…

    github.com/cortexproject/cortex Go