TI-2022-04325 Aliases CVE-2022-4729 GHSA-q99p-78hp-xg5c

Graphite Web Template Name cross site scripting

HIGH 66CWE-707Published 2022-12-24 · Updated 2025-04-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00789 56th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Graphite	Web	all versions	—	No fix listed	CNA
—	graphite-web (PyPI)	up to 1.1.10	—	No fix listed	GHSA-q99p-78hp-xg5c

Web VendorGraphite Affected all versions Fixed in — No fix listed CNA
graphite-web (PyPI) Vendor— Affected up to 1.1.10 Fixed in — No fix listed GHSA-q99p-78hp-xg5c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:graphite_project:graphite:-:::::::*	not specified by NVD	Vulnerable	Graphite

cpe:2.3:a:graphite_project:graphite:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Graphite

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Storage 3	Affected	No fix planned: Out of support scope

Timeline

2026-10-02 Threatist record created from CVE-2022-4729
2026-10-03 Alias added: GHSA-q99p-78hp-xg5c

References

Exploit 1

https://github.com/graphite-project/graphite-web/issues/2745

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-4729

Other 1

https://github.com/graphite-project/graphite-web

TI-2022-04326 Graphite Web Absolute Time Range cross site scripting CVSS 3.1MEDIUM 5.4
TI-2022-04324 Graphite Web Cookie cross site scripting CVSS 3.1MEDIUM 5.4
TI-2013-04426 The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through… CVSS 2.0MEDIUM 6.8
TI-2017-13792 send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is… CVSS 3.1HIGH 7.5
TI-2013-05065 Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote… CVSS 2.0MEDIUM 6.8
TI-2013-05066 Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences