Alta

graphite.composer.views.send_email vulnerable to SSRF

Publicada: 11.10.2019
Actualizado: 11.10.2026 13:19

Impact

send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. Email will be send through SMTP server configured in Graphite, by default it's 'localhost'

Patches

Problem was patched in Graphite-web 1.1.6. Also patches was released for graphite-web 1.0.x and 0.9.x, and we'll discuss releases of non-supported branches later.

Workarounds

You can manually remove function send_email from file webapp/graphite/composer/views.py. This function are not in use and will not affect your Graphite installation.

References

For more information check this graphite-web Github issue #2008

For more information

If you have any questions or comments about this advisory:

Add comment in issue #2008

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	graphite-web	< 1.1.6	1.1.6

Referencias

Puntuación CVSS 7.5/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE): CWE-918
Plataforma: Python (PyPI)
Paquete: graphite-web
Publicada: 11.10.2019
Actualizado: 11.10.2026 13:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2019-151 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-vfj6-275q-4pvm - CC BY 4.0

Historial de vulnerabilidades: graphite-web

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 7
Primera → última: 09.2013 12.2022
Sin corrección: 3
Explotada en ataques: 0

Distribución por gravedad

Crítica 2
Alta 1
Media 3
Sin evaluar 1

Divulgaciones por año

2017: 0
2018: 0
2019: 1
2020: 0
2021: 0
2022: 3
2023: 0
2024: 0
2025: 0
2026: 0

antes: 3

27.12.2022

Graphite Web Cross-site Scripting vulnerability

Media · 5.4 CVE-2022-4730 <= 1.1.10 sin corrección
27.12.2022

Graphite Web Cross-site Scripting vulnerability

Media · 5.4 CVE-2022-4729 <= 1.1.10 sin corrección
27.12.2022

Graphite Web Cross-site Scripting vulnerability

Media · 5.4 CVE-2022-4728 <= 1.1.10 sin corrección
11.10.2019

graphite.composer.views.send_email vulnerable to SSRF esta entrada

Alta · 7.5 CVE-2017-18638 < 1.1.6 1.1.6
27.09.2013

Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remote_storage.py, (2) sto

Crítica · 9.0 CVE-2013-5942 >= 0.9.5, < 0.9.11 0.9.11
27.09.2013

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a c

Crítica · 9.0 CVE-2013-5093 >= 0.9.5, < 0.9.11 0.9.11
27.09.2013

Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Sin evaluar CVE-2013-5943 < 0.9.11 0.9.11

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación