Skip to content
OpenAdvisories

Package · Go

github.com/cortexproject/cortex

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-23536

    Alertmanager can expose local files content via specially crafted config

    Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertm…

    cortexproject cortex github.com/cortexproject/cortex Go
  • Medium —
    CVE-2021-36157

    Path traversal in Grafana Cortex

    An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will att…

    github.com/cortexproject/cortex Go
  • Medium 5.5
    CVE-2021-31232

    Improper input validation in CNCF Cortex

    The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanag…

    github.com/cortexproject/cortex Go