CVE-2017-18638

send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.

• CWE-918

• https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrfExploit, Mitigation, Third Party Advisory
• https://github.com/graphite-project/graphite-web/issues/2008Third Party Advisory
• https://github.com/graphite-project/graphite-web/pull/2499Third Party Advisory
• https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvmBroken Link
• https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
• https://www.youtube.com/watch?v=ds4Gp4xoaeAExploit, Third Party Advisory
• https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrfExploit, Mitigation, Third Party Advisory
• https://github.com/graphite-project/graphite-web/issues/2008Third Party Advisory
• https://github.com/graphite-project/graphite-web/pull/2499Third Party Advisory
• https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvmBroken Link
• https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html
• https://www.youtube.com/watch?v=ds4Gp4xoaeAExploit, Third Party Advisory

Published

Oct 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18615The kama-clic-counter plugin before 3.5.0 for WordPress has …6.1
• CVE-2017-1862Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1863Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18634The newspaper theme before 6.7.2 for WordPress has script in…9.8
• CVE-2017-18635An XSS vulnerability was discovered in noVNC before 0.6.2 in…6.1
• CVE-2017-18636CDG through 2017-01-01 allows downloadDocument.jsp?command=d…7.5
• CVE-2017-18639Progress Sitefinity CMS before 10.1 allows XSS via /Pages Pa…6.1
• CVE-2017-1864Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18640The Alias feature in SnakeYAML before 1.26 allows entity exp…7.5
• CVE-2017-18641In LXC 2.0, many template scripts download code over clearte…8.1
• CVE-2017-18642Syska Smart Bulb devices through 2017-08-06 receive RGB para…6.5
• CVE-2017-18643An issue was discovered on Samsung mobile devices with M(6.x…7.5