Linuxfoundation Cortex vulnerabilities

4 CVEs affecting Linuxfoundation Cortex, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-41265, published 2024-08-01.

More from Linuxfoundation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-36157, published 2021-08-03. Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days. An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae…
• CVE-2022-23536, published 2022-12-19. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read…
• CVE-2021-31232, published 2021-04-30. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack…
• CVE-2024-41265, published 2024-08-01. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.