CVE-2017-18638
high · 7.5A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
7.5
CVSS
15.3%
EPSS (exploit prob.)
97th
EPSS percentile
2019-10-11
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| graphite_project | graphite | <= 1.1.5 |
Check a specific version with /api/v1/cve/match.
References
- https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf
- https://github.com/graphite-project/graphite-web/issues/2008
- https://github.com/graphite-project/graphite-web/pull/2499
- https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
- https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
- https://www.youtube.com/watch?v=ds4Gp4xoaeA
- https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf
- https://github.com/graphite-project/graphite-web/issues/2008
- https://github.com/graphite-project/graphite-web/pull/2499
- https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
- https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
- https://www.youtube.com/watch?v=ds4Gp4xoaeA
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2017-18638