CVE-2022-4729: Graphite Web Cross-site Scripting vulnerability
Summary
CVE-2022-4729: Graphite Web Cross-site Scripting vulnerability. Affects graphite-web versions < 1.1.10. No fix is published. How to fix ↓
Also tracked for
- graphite-web · Debian:12
The same CVE-2022-4729 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphite Web is a component of the Graphite stack, which is a highly scalable real-time graphing system. It provides a web interface for visualizing and analyzing time-series data. The affected package, graphite-web, is a Python package available on the Python Package Index (PyPI). It is used to render and serve Graphite web pages. This vulnerability affects versions 0 to 1.1.10 of graphite-web.
Vulnerability Detail
The vulnerability identified as CVE-2022-4729 is a cross-site scripting (XSS) vulnerability in Graphite Web's Template Name Handler component. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The Graphite Web Cross-site Scripting vulnerability (CVE-2022-4729) affects versions 0 to 1.1.10 of the graphite-web package. It allows for cross-site scripting attacks, potentially leading to unauthorized access or data theft. To fix this vulnerability, users should apply the provided patch. For more information and support, please contact DevNack.com.
See every vulnerability recorded for graphite-web →
FAQ
Graphite Web is a component of the Graphite stack, providing a web interface for visualizing and analyzing time-series data.
This vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, or other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file to the playground without any signup.
No, a patch is required to fix this vulnerability. Applying the provided patch is the recommended solution.
For further information and support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for graphite-web.
