CVE-2020-35476

State: Published
Severity: Not scored
Published: Dec 16, 2020
Updated: Aug 4, 2024
Reserved: Dec 16, 2020

Description

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/OpenTSDB/opentsdb/issues/2051
http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.