CVE-2013-5093: graphite_project graphite Code Injection
Vulnerability summary
CVE-2013-5093 is a medium (CVSS 6.8) Code Injection vulnerability in graphite_project graphite. EPSS estimates a 38.67% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 6 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Duplicates 1Timeline
- 27-09-2013PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
38.67%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 38.67% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
6 foundGraphite Web
Maturity: poc
Metasploit Framework
Maturity: poc
Exploit Reference (ceriksen.com)
Maturity: unknown
Show all 6 exploits
Exploit Reference (securityfocus.com)
Maturity: unknown
Graphite Web - Unsafe Pickle Handling (Metasploit)
Maturity: weaponized
Graphite Web Unsafe Pickle Handling
exploit/unix/webapp/graphite_pickle_exec
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian1 product
- graphite-web< 0.9.12+debian-1
Graphite_project1 product
- graphite0.9.5 | 0.9.6 | 0.9.7 | 0.9.8 | 0.9.9 | 0.9.10
PyPI1 product
- graphite-web≥ 0.9.5, < 0.9.11
3 vendors · 3 products
References
15 links- ceriksen.com/2013/08/20/graphite-remote-code-execution-vulnerability-advisory/X Refsource MISCExploitAdvisory
- github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rstX Refsource CONFIRMExploitPatchWEB
