A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects
    unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack
    can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the
    patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue.
    VDB-216742 is the identifier assigned to this vulnerability. (CVE-2022-4728)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects     unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack     can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the     patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue.
    VDB-216742 is the identifier assigned to this vulnerability. (CVE-2022-4728)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6243-1 advisory.

    It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to perform server-side request forgery and obtain sensitive information. This issue only affected Ubuntu     16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)

    It was discovered that Graphite-Web incorrectly handled certain inputs. If a user or an automated system     were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue     to perform

    cross site scripting and obtain sensitive information. (CVE-2022-4728, CVE-2022-4729, CVE-2022-4730)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3309 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3309-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     February 06, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : graphite-web     Version        : 1.1.4-3+deb10u2     CVE IDs        : CVE-2022-4728 CVE-2022-4729 CVE-2022-4730     Debian Bug     : 1026992

    It was discovered that there were a number of issues in graphite-web,     a tool provide realtime graphing of system statistics etc.

    A series of cross-site scripting (XSS) vulnerabilties existed that     could have been exploited remotely. Issues existed in the Cookie     Handler, Template Name Handler and Absolute Time Range Handler     components.

    For Debian 10 buster, these problems have been fixed in version     1.1.4-3+deb10u2.

    We recommend that you upgrade your graphite-web packages.

    For the detailed security status of graphite-web please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/graphite-web

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
446716	SCA: security update for graphite-web (GHSA-3c5x-4hvx-qrrr)	Tenable Cloud Security	SCA Checks	Local	medium
446716	SCA: security update for graphite-web (GHSA-3c5x-4hvx-qrrr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
259036	Linux Distros Unpatched Vulnerability : CVE-2022-4728	Nessus	Misc.	Local	medium
178780	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : Graphite-Web vulnerabilities (USN-6243-1)	Nessus	Ubuntu Local Security Checks	Local	high
171060	Debian dla-3309 : graphite-web - security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2022-4728

medium

Tenable Plugins

medium

medium

medium

high

medium