CVE-2017-18638
2 advisories.
PyPI/graphite-web CVE-2017-18638: high 7.5, EPSS 15.30%
graphite.composer.views.send_email vulnerable to SSRF
Action: Upgrade graphite-web to 1.1.6 or later.
pip install graphite-web==1.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.6 | - |
Fixed versions
| 1.1.6 |
Sources
- osv: GHSA-vfj6-275q-4pvm
- https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
- https://nvd.nist.gov/vuln/detail/CVE-2017-18638
- https://github.com/graphite-project/graphite-web/issues/2008
- https://github.com/graphite-project/graphite-web/pull/2499
- https://github.com/graphite-project/graphite-web/commit/71726a0e41a5263f49b973a7b856505a5b931c1f
- https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf
- https://github.com/graphite-project/graphite-web
- https://github.com/pypa/advisory-database/tree/main/vulns/graphite-web/PYSEC-2019-151.yaml
- https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
- https://www.youtube.com/watch?v=ds4Gp4xoaeA
CVE-2017-18638 · published · modified · JSON
PyPI/graphite-web CVE-2017-18638: unknown, EPSS 15.30%
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server re
Action: Upgrade graphite-web to 1.1.6 or later.
pip install graphite-web==1.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.6 | - |
Fixed versions
| 1.1.6 |
Sources
- osv: PYSEC-2019-151
- https://www.youtube.com/watch?v=ds4Gp4xoaeA
- https://github.com/graphite-project/graphite-web/issues/2008
- https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm
- https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf
- https://github.com/graphite-project/graphite-web/pull/2499
- https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
CVE-2017-18638 · published · modified · JSON