5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
6.1 Medium
AI Score
Confidence
High
4.9 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:P/A:N
Debian LTS Advisory DLA-3309-1 [email protected]
https://www.debian.org/lts/security/ Chris Lamb
February 06, 2023 https://wiki.debian.org/LTS
Package : graphite-web
Version : 1.1.4-3+deb10u2
CVE IDs : CVE-2022-4728 CVE-2022-4729 CVE-2022-4730
Debian Bug : 1026992
It was discovered that there were a number of issues in graphite-web,
a tool provide realtime graphing of system statistics etc.
A series of cross-site scripting (XSS) vulnerabilties existed that
could have been exploited remotely. Issues existed in the Cookie
Handler, Template Name Handler and Absolute Time Range Handler
components.
For Debian 10 buster, these problems have been fixed in version
1.1.4-3+deb10u2.
We recommend that you upgrade your graphite-web packages.
For the detailed security status of graphite-web please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/graphite-web
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 10 | all | graphite-web | <Â 1.1.4-3+deb10u2 | graphite-web_1.1.4-3+deb10u2_all.deb |
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
6.1 Medium
AI Score
Confidence
High
4.9 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:P/A:N