CVE-2021-36157: Path Traversal

August 3, 2021 (updated August 11, 2021)

An issue was discovered in Grafana Cortex The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as as ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message.

References

grafana.com/docs/grafana/latest/release-notes/
nvd.nist.gov/vuln/detail/CVE-2021-36157

Code Behaviors & Features

Detect and mitigate CVE-2021-36157 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →