TI-2022-04326 Aliases CVE-2022-4730 GHSA-m973-4vpc-x43c

Graphite Web Absolute Time Range cross site scripting

HIGH 66CWE-707Published 2022-12-24 · Updated 2025-04-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00823 57th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Graphite	Web	all versions	—	No fix listed	CNA
—	graphite-web (PyPI)	up to 1.1.10	—	No fix listed	GHSA-m973-4vpc-x43c

Web VendorGraphite Affected all versions Fixed in — No fix listed CNA
graphite-web (PyPI) Vendor— Affected up to 1.1.10 Fixed in — No fix listed GHSA-m973-4vpc-x43c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:graphite_project:graphite:-:::::::*	not specified by NVD	Vulnerable	Graphite

cpe:2.3:a:graphite_project:graphite:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Graphite

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Storage 3	Affected	No fix planned: Out of support scope

Timeline

2026-10-02 Threatist record created from CVE-2022-4730
2026-10-03 Alias added: GHSA-m973-4vpc-x43c

References

Exploit 1

https://github.com/graphite-project/graphite-web/issues/2746

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-4730

Other 1

https://github.com/graphite-project/graphite-web

TI-2022-04325 Graphite Web Template Name cross site scripting CVSS 3.1MEDIUM 5.4
TI-2022-04324 Graphite Web Cookie cross site scripting CVSS 3.1MEDIUM 5.4
TI-2013-04426 The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through… CVSS 2.0MEDIUM 6.8
TI-2017-13792 send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is… CVSS 3.1HIGH 7.5
TI-2013-05065 Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote… CVSS 2.0MEDIUM 6.8
TI-2013-05066 Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences