CVE-2017-18638
HIGH NUCLEIGraphite <1.1.5 - SSRF
Title source: llmDescription
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
Nuclei Templates (1)
Graphite <=1.1.5 - Server-Side Request Forgery
HIGHby huowuzhao
References (6)
Scores
CVSS v3
7.5
EPSS
0.8748
EPSS Percentile
99.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-918
Status
published
Products (2)
graphite_project/graphite
< 1.1.5
pypi/graphite-web
0 - 1.1.6PyPI
Published
Oct 11, 2019
Tracked Since
Feb 18, 2026