Overview
About vulnerability
The CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/rules/{namespace}
Thanks to Prasanth Sundararajan for reporting this vulnerability.
Details
- Affected product:
- Alpine Linux 3.23 , Debian 12 , Debian 13 , Grafana , Loki
- Affected packages:
- Loki @ 3.3.0 (+18 more)