Grafana Mimir Alertmanager config check gap allows server file reads
Users allowed to edit alert settings can peek at the server's private files.
Summary
Grafana Mimir's Alertmanager checks receiver configurations for local files but misses two HTTP client settings. A tenant allowed to write an Alertmanager configuration can read files from the Alertmanager host, such as credentials and configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected.
Affected when
- Permission to write the tenant's Alertmanager configuration
What to do
Update Grafana Mimir to 3.1.7 or 3.2.2, or GEM to 2.17.20 or later. GEM 2.11 through 2.16 will not get a fix, so upgrade those to 2.17.20 or later.
Update to at least the version for your product:
- Grafana Mimir 3.1 3.1.7 or later
- Grafana Mimir 3.2 3.2.2 or later
- Grafana Enterprise Metrics 2.17 2.17.20 or later
Products and platforms
CVE IDs
Sources
- Advisory: grafana.com (opens in a new tab)
Times
First published
First seen