CVE-2021-31231
Assigner: mitre
Published: 2021-04-30T12:34:28
State: PUBLISHED
affected: product: n/a
vendor: n/a
versions: status: affected
version: n/a
descriptions: value: The Alertmanager in Grafana Enterprise Metrics before 1.2.1 and Metrics Enterprise 1.2.1 has a local file disclosure vulnerability when experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
problemTypes: descriptions: description: n/a
type: text