Arbitrary Code Injection Affecting graphite-web package, versions [0.9.5,0.9.11)
Threat Intelligence
Exploit Maturity
Mature
EPSS
96.63% (100th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-GRAPHITEWEB-40229
- published 7 Aug 2013
- disclosed 7 Aug 2013
- credit Charlie Eriksen
Overview
graphite-web is a Enterprise scalable realtime graphing
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
References
CVSS Scores
version 3.1