CVE-2017-18638 graphite.composer.views.send_email vulnerable to SSRF
HighCVSS 7.5
EPSS 15.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi graphite-web(PyPI) | < 1.1.6 | 1.1.6 |
| pypi graphite-web(PyPI) | = 0.9.10 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.11 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.12 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.13 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.14 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.15 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.16 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.5 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.6 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.7 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.7b | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.7c | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.8 | No fix listed |
| pypi graphite-web(PyPI) | = 0.9.9 | No fix listed |
| pypi graphite-web(PyPI) | = 1.0.0 | No fix listed |
| pypi graphite-web(PyPI) | = 1.0.1 | No fix listed |
| pypi graphite-web(PyPI) | = 1.0.2 | No fix listed |
| pypi graphite-web(PyPI) | = 1.1.0 | No fix listed |
| pypi graphite-web(PyPI) | = 1.1.1 | No fix listed |
| pypi graphite-web(PyPI) | = 1.1.2 | No fix listed |
| pypi graphite-web(PyPI) | = 1.1.3 | No fix listed |
| pypi graphite-web(PyPI) | = 1.1.4 | No fix listed |
| pypi graphite-web(PyPI) | = 1.1.5 | No fix listed |
| debian/graphite-web(Debian:12) | < 1.1.4-5 | 1.1.4-5 |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/graphite-web(Debian:13) | < 1.1.4-5 | 1.1.4-5 |
| debian/graphite-web(Debian:14) | < 1.1.4-5 | 1.1.4-5 |
| graphite project graphite | <= 1.1.5 | No fix listed |
References
- github.com broken-link vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com patch
- blog.orange.tw exploit mitigation technical-description third-party-advisory
- github.com product
- github.com
- [debian-lts-announce] 20191021 [SECURITY] [DLA 1962-1] graphite-web security update mailing-list
- www.youtube.com exploit third-party-advisory
- github.com
- Debian Security Tracker CVE-2017-18638 vendor-advisory