{"action":"Upgrade github.com/cortexproject/cortex to 1.13.2 or later.","affected":[{"fixed":"1.14.1","introduced":"1.14.0"},{"fixed":"1.13.2","introduced":"1.13.0"}],"component":"github.com/cortexproject/cortex","cve_ids":["CVE-2022-23536"],"ecosystem":"Go","epss":0.00817,"exploited":false,"fixed_versions":["1.14.1","1.13.2"],"ghsa_id":"GHSA-cq2g-pw6q-hf7j","id":"tcs_01M5KF7PXM3FZVJMR9291V276Y","modified_at":"2023-11-08T04:08:21.294648Z","published_at":"2022-12-19T21:09:05Z","references":["https://osv.dev/vulnerability/GHSA-cq2g-pw6q-hf7j","https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j","https://nvd.nist.gov/vuln/detail/CVE-2022-23536","https://github.com/cortexproject/cortex/commit/03e023d8b012887b31cc268d0d011b01e1e65506","https://cortexmetrics.io/docs/api/#set-alertmanager-configuration","https://github.com/cortexproject/cortex","https://github.com/cortexproject/cortex/releases/tag/v1.13.2","https://github.com/cortexproject/cortex/releases/tag/v1.14.1","https://pkg.go.dev/vuln/GO-2022-1175"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cq2g-pw6q-hf7j","url":"https://osv.dev/vulnerability/GHSA-cq2g-pw6q-hf7j"}],"summary":"Cortex's Alertmanager can expose local files content via specially crafted config"}