A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2020-12-16T00:00:00
Updated: 2024-08-04T17:02:08.232Z
Reserved: 2020-12-16T00:00:00
Link: CVE-2020-35476
Vulnrichment
No data.
NVD
Status : Modified
Published: 2020-12-16T08:15:13.560
Modified: 2024-11-21T05:27:22.250
Link: CVE-2020-35476
Redhat
No data.