OpenTSDB vulnerable to OS Command Injection

2022-05-1301:49:41

Google

osv.dev

0.002 Low

EPSS

Percentile

56.9%

JSON

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.

CPENameOperatorVersion
net.opentsdb:opentsdbeq2.2.0
net.opentsdb:opentsdbeq2.3.0-RC1
net.opentsdb:opentsdbeq2.2.2
net.opentsdb:opentsdbeq2.3.0-RC2
net.opentsdb:opentsdbeq2.2.0RC1
net.opentsdb:opentsdbeq2.3.0
net.opentsdb:opentsdbeq2.1.3
net.opentsdb:opentsdbeq2.2.1

Name	Operator	Version
net.opentsdb:opentsdb	eq	2.2.0
net.opentsdb:opentsdb	eq	2.3.0-RC1
net.opentsdb:opentsdb	eq	2.2.2
net.opentsdb:opentsdb	eq	2.3.0-RC2
net.opentsdb:opentsdb	eq	2.2.0RC1
net.opentsdb:opentsdb	eq	2.3.0
net.opentsdb:opentsdb	eq	2.1.3
net.opentsdb:opentsdb	eq	2.2.1