TI-2022-04324 Aliases CVE-2022-4728 GHSA-3c5x-4hvx-qrrr

Graphite Web Cookie cross site scripting

HIGH 66CWE-707Published 2022-12-24 · Updated 2025-04-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00823 57th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Graphite	Web	all versions	—	No fix listed	CNA
—	graphite-web (PyPI)	up to 1.1.10	—	No fix listed	GHSA-3c5x-4hvx-qrrr

Web VendorGraphite Affected all versions Fixed in — No fix listed CNA
graphite-web (PyPI) Vendor— Affected up to 1.1.10 Fixed in — No fix listed GHSA-3c5x-4hvx-qrrr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:graphite_project:graphite:-:::::::*	not specified by NVD	Vulnerable	Graphite

cpe:2.3:a:graphite_project:graphite:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Graphite

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Storage 3	Affected	No fix planned: Out of support scope

Timeline

2026-10-02 Threatist record created from CVE-2022-4728
2026-10-03 Alias added: GHSA-3c5x-4hvx-qrrr

References

Exploit 1

https://github.com/graphite-project/graphite-web/issues/2744

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-4728

Other 1

https://github.com/graphite-project/graphite-web

TI-2022-04326 Graphite Web Absolute Time Range cross site scripting CVSS 3.1MEDIUM 5.4
TI-2022-04325 Graphite Web Template Name cross site scripting CVSS 3.1MEDIUM 5.4
TI-2013-04426 The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through… CVSS 2.0MEDIUM 6.8
TI-2017-13792 send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is… CVSS 3.1HIGH 7.5
TI-2013-05065 Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote… CVSS 2.0MEDIUM 6.8
TI-2013-05066 Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences