CVE-2021-36156: Path Traversal

August 3, 2021 (updated September 14, 2021)

An issue was discovered in Grafana Loki The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as a ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

References

github.com/grafana/loki/pull/4020
nvd.nist.gov/vuln/detail/CVE-2021-36156

Code Behaviors & Features

Detect and mitigate CVE-2021-36156 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →