GHSA-jphm-g89m-v42p
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jphm-g89m-v42p
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-jphm-g89m-v42p/GHSA-jphm-g89m-v42p.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-jphm-g89m-v42p
- Aliases
- Published
- 2021-09-02T21:59:50Z
- Modified
- 2023-11-01T04:55:44.113991Z
- Summary
- Path traversal in Grafana Cortex
- Details
-
An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)
- Database specific
{ "github_reviewed": true, "github_reviewed_at": "2021-08-04T18:31:56Z", "cwe_ids": [ "CWE-22" ], "nvd_published_at": "2021-08-03T15:15:00Z", "severity": "MODERATE" }- References
Affected packages
Go / github.com/cortexproject/cortex
Package
- Name
- github.com/cortexproject/cortex
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/cortexproject/cortex