CVE-2021-36156: Path Traversal

August 3, 2021 (updated September 14, 2021)

An issue was discovered in Grafana Loki The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as a ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

References

github.com/grafana/loki/pull/4020
nvd.nist.gov/vuln/detail/CVE-2021-36156

Code Behaviors & Features

Detect and mitigate CVE-2021-36156 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →