Detections
Analytics

SCA: security update for graphite-web (GHSA-vfj6-275q-4pvm)

high Tenable Self-Hosted Container Security Plugin ID 422213

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to
 SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any
 resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail
 address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
 (CVE-2017-18638)

See Also

https://github.com/advisories/GHSA-vfj6-275q-4pvm

Plugin Details

Severity: High

ID: 422213

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2017-18638

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 8.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/25/2019

Vulnerability Publication Date: 10/11/2019

Reference Information

CVE: CVE-2017-18638

cwe: CWE-918