{"id":"USN-6243-2","aliases":[],"status":"published","title":"graphite-web regression","description":"USN-6243-1 fixed vulnerabilities in Graphite-Web. It was discovered that the\napplied fix was incomplete. This update fixes the problem.\n\nOriginal advisory details:\n\n It was discovered that Graphite-Web incorrectly handled certain inputs. If a\n user or an automated system were tricked into opening a specially crafted\n input file, a remote attacker could possibly use this issue to perform\n server-side request forgery and obtain sensitive information. This issue\n only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)\n \n It was discovered that Graphite-Web incorrectly handled certain inputs. If a\n user or an automated system were tricked into opening a specially crafted\n input file, a remote attacker could possibly use this issue to perform \n cross site scripting and obtain sensitive information. (CVE-2022-4728,\n CVE-2022-4729, CVE-2022-4730)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-08-09T14:16:34Z","modified":"2026-02-10T04:43:12Z","fixes":[{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphite-web","fixed_in":["1.0.2+debian-2ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"graphite-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2+debian-2ubuntu0.1~esm2"}]}],"versions":["0.9.15+debian-2","1.0.2+debian-2","1.0.2+debian-2ubuntu0.1~esm1"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-6243-2","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2030807","tags":["report"]}],"sources":{"osv":[{"id":"USN-6243-2","title":"graphite-web regression","description":"USN-6243-1 fixed vulnerabilities in Graphite-Web. It was discovered that the\napplied fix was incomplete. This update fixes the problem.\n\nOriginal advisory details:\n\n It was discovered that Graphite-Web incorrectly handled certain inputs. If a\n user or an automated system were tricked into opening a specially crafted\n input file, a remote attacker could possibly use this issue to perform\n server-side request forgery and obtain sensitive information. This issue\n only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2017-18638)\n \n It was discovered that Graphite-Web incorrectly handled certain inputs. If a\n user or an automated system were tricked into opening a specially crafted\n input file, a remote attacker could possibly use this issue to perform \n cross site scripting and obtain sensitive information. (CVE-2022-4728,\n CVE-2022-4729, CVE-2022-4730)\n","status":"published","published":"2023-08-09T14:16:34Z","modified":"2026-02-10T04:43:12Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}