CVE-2017-18638

{"id": "CVE-2017-18638", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-10-11T23:15:10.447", "references": [{"url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/graphite-project/graphite-web/issues/2008", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/graphite-project/graphite-web/pull/2499", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html", "source": "cve@mitre.org"}, {"url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.orange.tw/2017/07/how-i-chained-4-vulnerabilities-on.html#second-bug-internal-graphite-ssrf", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/graphite-project/graphite-web/issues/2008", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/graphite-project/graphite-web/pull/2499", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/graphite-project/graphite-web/security/advisories/GHSA-vfj6-275q-4pvm", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00030.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.youtube.com/watch?v=ds4Gp4xoaeA", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information."}, {"lang": "es", "value": "La funci\u00f3n send_email en el archivo graphite-web/webapp/graphite/composer/views.py en Graphite versiones hasta 1.1.5 es susceptible a una vulnerabilidad de tipo SSRF. Un atacante puede utilizar el endpoint SSRF vulnerable para que el servidor web Graphite solicite cualquier recurso. La respuesta a esta petici\u00f3n SSRF es codificada en un archivo de imagen y luego se env\u00eda a una direcci\u00f3n de correo electr\u00f3nico que puede ser proporcionada por el atacante. Por lo tanto, un atacante puede filtrar cualquier informaci\u00f3n."}], "lastModified": "2024-11-21T03:20:32.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:graphite_project:graphite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6FBCDF9-4EB9-41AD-9B62-E99FBF3DCF3B", "versionEndIncluding": "1.1.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}