CVE-2021-31232

cortex: Alertmanager can expose local files content via specially crafted config

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · April 28, 2021

Updated · June 27, 2026

Description

A flaw was found in Cortex that may allow a local attacker to obtain sensitive information. This is due to an issue in the Alertmanager when -experimental.alertmanager.enable-api is used. By using a webhook to send file content, an attacker can load any text file specified in the templates list, obtain sensitive information, and use this information to launch further attacks against the affected system.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor