Threats tagged 'ghsa-243g-h4f6-prqr'

Grafana Mimir's Alertmanager contains a vulnerability where tenant-supplied Alertmanager configurations can reference local files via certain HTTP client settings not properly checked. This allows a tenant with configuration write permissions to read arbitrary files on the Alertmanager host by including their contents in outgoing request headers. The issue affects Grafana Mimir and Grafana Enterprise Metrics (GEM). Fixed versions are Mimir 3.1.7 and 3.2.2, and GEM 2.17.20 and later. Older GEM versions 2.11 through 2.16 will not receive fixes and require upgrading.