CVE-2017-18638 describes a Server-Side Request Forgery (SSRF) vulnerability in Graphite through version 1.1.5, specifically within the send_email function of graphite-web/webapp/graphite/composer/views.py. This flaw allows an unauthenticated attacker to force the Graphite web server to request arbitrary resources, with the response encoded into an image and sent to an attacker-controlled email address, enabling data exfiltration. With a CVSS score of 7.5 (HIGH) and an EPSS score indicating high exploitability, this vulnerability presents a significant risk due to its network-based attack vector and low attack complexity. While not listed on CISA KEV or having Metasploit/ExploitDB entries, Nuclei templates exist for detection, and despite its age, it receives minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.1.5CPE matchmatch criteria | cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.