CVE-2017-18638

CVE-2017-18638 affects Graphite’s graphite-web send_email() in the composer/views.py path up to version 1.1.5. It allows SSRF: the Graphite web server can fetch arbitrary resources and embed the response in an image sent via email, enabling information exfiltration. The issue is fixed in Graphite...