{"action":"Upgrade graphite-web to 1.1.6 or later.","affected":[{"fixed":"1.1.6","introduced":"0"}],"component":"graphite-web","cve_ids":["CVE-2017-18638"],"ecosystem":"PyPI","epss":0.15301,"exploited":false,"fixed_versions":["1.1.6"],"ghsa_id":"GHSA-vfj6-275q-4pvm","id":"tcs_01M5KG8M257J604TFXH6RNSAX5","modified_at":"2023-11-08T03:59:16.529146Z","published_at":"2019-10-11T23:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-151","https://www.youtube.com/watch?v=ds4Gp4xoaeA","https://github.com/graphite-project/graphite-web/issues/2008","https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm","https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf","https://github.com/graphite-project/graphite-web/pull/2499","https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-151","url":"https://osv.dev/vulnerability/PYSEC-2019-151"}],"summary":"send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server re"}