PT-2021-19211 · Grafana · Metrics Enterprise+1

Published 2021-04-30 · Updated 2023-08-08 · CVE-2021-31231

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grafana Enterprise Metrics versions prior to 1.2.1 Metrics Enterprise version 1.2.1

Description The issue allows for local file disclosure when the experimental.alertmanager.enable-api is used. The HTTP basic auth password file can be exploited to send any file content via a webhook. Additionally, the alertmanager templates can be used to send any file content because the alertmanager can load any text file specified in the templates list.

Recommendations For Grafana Enterprise Metrics versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue. For Metrics Enterprise version 1.2.1, consider disabling the experimental.alertmanager.enable-api until a patch is available. As a temporary workaround, restrict access to the alertmanager templates to minimize the risk of exploitation. Avoid using the password file in the HTTP basic auth configuration until the issue is resolved.

Fix

Related Identifiers

CVE-2021-31231

Affected Products

Grafana Enterprise Metrics

Metrics Enterprise

References · 9

• https://grafana.com/docs/metrics-enterprise · Vendor Advisory
• https://grafana.com/docs/metrics-enterprise/latest/downloads/#v121----april-27-2021 · Vendor Advisory
• https://grafana.com/docs/metrics-enterprise/latest/downloads/#v113----april-27-2021 · Vendor Advisory
• https://community.grafana.com/c/security-announcements · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31231 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31231 · Vendor Advisory
• https://t.me/cvenotify/16161 · Telegram Post
• https://t.me/cvenotify/31130 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210611-0001 · Note