CVE-2017-18638

send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF

published October 11, 2019

CVSS
—
EPSS
15%
Percentile
96.7
In the wild
Unconfirmed
What it is

send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.15301 · 96.7th percentile
Published
2019-10-11T22:01Z
EPSS history
Timeline
  • 11 OCT 22:01Z
    send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF
    cvelistv5