{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-10-21T15:05:28", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/graphite-project/graphite-web/issues/2008"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf"}, {"tags": ["x_refsource_MISC"], "url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/graphite-project/graphite-web/pull/2499"}, {"name": "[debian-lts-announce] 20191021 [SECURITY] [DLA 1962-1] graphite-web security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2017-18638", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm", "refsource": "MISC", "url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm"}, {"name": "https://github.com/graphite-project/graphite-web/issues/2008", "refsource": "MISC", "url": "https://github.com/graphite-project/graphite-web/issues/2008"}, {"name": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf", "refsource": "MISC", "url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf"}, {"name": "https://www.youtube.com/watch?v=ds4Gp4xoaeA", "refsource": "MISC", "url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA"}, {"name": "https://github.com/graphite-project/graphite-web/pull/2499", "refsource": "MISC", "url": "https://github.com/graphite-project/graphite-web/pull/2499"}, {"name": "[debian-lts-announce] 20191021 [SECURITY] [DLA 1962-1] graphite-web security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T21:28:55.975Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/graphite-project/graphite-web/issues/2008"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/graphite-project/graphite-web/pull/2499"}, {"name": "[debian-lts-announce] 20191021 [SECURITY] [DLA 1962-1] graphite-web security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-18638", "datePublished": "2019-10-11T22:01:28", "dateReserved": "2019-10-11T00:00:00", "dateUpdated": "2024-08-05T21:28:55.975Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6FBCDF9-4EB9-41AD-9B62-E99FBF3DCF3B", "versionEndIncluding": "1.1.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information."}, {"lang": "es", "value": "La funci\u00f3n send_email en el archivo graphite-web/webapp/graphite/composer/views.py en Graphite versiones hasta 1.1.5 es susceptible a una vulnerabilidad de tipo SSRF. Un atacante puede utilizar el endpoint SSRF vulnerable para que el servidor web Graphite solicite cualquier recurso. La respuesta a esta petici\u00f3n SSRF es codificada en un archivo de imagen y luego se env\u00eda a una direcci\u00f3n de correo electr\u00f3nico que puede ser proporcionada por el atacante. Por lo tanto, un atacante puede filtrar cualquier informaci\u00f3n."}], "id": "CVE-2017-18638", "lastModified": "2024-11-21T03:20:32.483", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2019-10-11T23:15:10.447", "references": [{"source": "[email protected]", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/graphite-project/graphite-web/issues/2008"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/graphite-project/graphite-web/pull/2499"}, {"source": "[email protected]", "tags": ["Broken Link"], "url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm"}, {"source": "[email protected]", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/graphite-project/graphite-web/issues/2008"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/graphite-project/graphite-web/pull/2499"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "[email protected]", "type": "Primary"}]}

{"bugzilla": {"description": "graphite-web: graphite.composer.views.send_email vulnerable to SSRF", "id": "2001847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2001847"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-918", "details": ["send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.", "A flaw was found in graphite-web. The send_email in the graphite-web/webapp/graphite/composer/views.py function is vulnerable to a Server-side request forgery (SSRF). This flaw allows an attacker to use the vulnerable SSRF endpoint to have the Graphite web server request any resource. An attacker can exfiltrate any information due to the response the SSRF request encodes into an image file sent to an email address supplied by the attacker."], "name": "CVE-2017-18638", "package_state": [{"cpe": "cpe:/a:redhat:ceph_storage:2", "fix_state": "Out of support scope", "package_name": "graphite-web", "product_name": "Red Hat Ceph Storage 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:3", "fix_state": "Out of support scope", "package_name": "graphite-web", "product_name": "Red Hat Ceph Storage 3"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "graphite-web", "product_name": "Red Hat Storage 3"}], "public_date": "2019-10-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-18638\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-18638\nhttps://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm"], "statement": "Graphite metrics / telemetry data does not contain any sensitive information and hence this flaw is rated as Moderate.", "threat_severity": "Moderate", "upstream_fix": "graphite-web 1.1.6"}