{"id":"GO-2022-1175","summary":"Exposure of local files in github.com/cortexproject/cortex","details":"A malicious actor could remotely read local files by submitting to the Alertmanager Set Configuration API maliciously crafted inputs. Only users of the Alertmanager service where \"-experimental.alertmanager.enable-api\" or \"enable_api: true\" is configured are affected.","aliases":["CVE-2022-23536","GHSA-cq2g-pw6q-hf7j"],"modified":"2024-05-20T16:03:47Z","published":"2022-12-22T17:41:59Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2022-1175"},"references":[{"type":"ADVISORY","url":"https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j"},{"type":"FIX","url":"https://github.com/cortexproject/cortex/commit/03e023d8b012887b31cc268d0d011b01e1e65506"},{"type":"WEB","url":"https://cortexmetrics.io/docs/api/#set-alertmanager-configuration"}],"affected":[{"package":{"name":"github.com/cortexproject/cortex","ecosystem":"Go","purl":"pkg:golang/github.com/cortexproject/cortex"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"},{"introduced":"1.14.0"},{"fixed":"1.14.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/cortexproject/cortex/pkg/alertmanager","symbols":["validateAlertmanagerConfig","validateGlobalConfig"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2022-1175.json"}}],"schema_version":"1.7.3","credits":[{"name":"Austin Robertson with Amazon Web Services"}]}