PatchTheCVEcortex vulnerabilities and fixes
Recent CVEs affecting cortex, with upgrade or downgrade steps. 5 tracked.
cortex has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2023-09-11. Highest priority: CVE-2023-39069 (score 54/100).
- CVE-2023-39069 CRITICAL 9.8 UPGRADE UPGRADE An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privilege
- CVE-2022-23536 MEDIUM 6.5 DOWNGRADE Cortex provides multi-tenant, long term storage for Prometheus
- CVE-2021-36157 MEDIUM 5.3 UPGRADE An issue was discovered in Grafana Cortex through 1.9.0
- CVE-2021-31232 MEDIUM 5.5 UPGRADE The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.aler
- CVE-2018-20226 HIGH 7.2 UPGRADE An organization administrator can add a super administrator in THEHIVE PROJECT Cortex before 2.1.3 due to the
FAQ
How do I fix cortex vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cortex being exploited right now?
None of the tracked cortex CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cortex CVE should I patch first?
CVE-2023-39069 currently ranks highest (54/100): An issue in StrangeBee TheHive v.5.0.8, v.4.1.21 and Cortex v.3.1.6 allows a remote attacker to gain privilege.