CVE-2023-25827

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25826

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

Input validation

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

Cross site scripting

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827 Cross-site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827 Cross-site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827 Cross-site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827

CVE-2023-25827 affects OpenTSDB; the root cause is insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, enabling reflected cross-site scripting (XSS) in a targeted user’s browser. Connected sources confirm the issue as a browser‑...

CVE-2023-25826 Remote Code Execution in OpenTSDB

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2023-25826 Remote Code Execution in OpenTSDB

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2023-25826

CVE-2023-25826 affects OpenTSDB via unauthenticated command injection in the HTTP query path (legacy API). The issue stems from insufficient validation of parameters (notably in the query API), allowing crafted commands to bypass regex filters and execute on the host. Public writeups and exploits...

CVE-2023-25826 Remote Code Execution in OpenTSDB

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

PT-2023-20332 · Opentsdb · Opentsdb

Name of the Vulnerable Software and Affected Versions: OpenTSDB affected versions not specified Description: The issue is caused by insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint. This allows an attacker to inject and execut...

OpenTSDB 操作系统命令注入漏洞

OpenTSDB is a suite of open source, scalable distributed time series databases. A security vulnerability exists in OpenTSDB versions 1.0.0 through 2.4.1, which stems from insufficient validation of parameters. An attacker exploiting this vulnerability could execute arbitrary code on the host syst...

CVE-2023-25827: Improper Neutralization of Input During Web Page Generation

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

OpenTSDB 跨站脚本漏洞

OpenTSDB is a suite of open source, scalable distributed time series databases. A security vulnerability exists in OpenTSDB versions 1.0.0 through 2.4.1, which stems from an insufficient validation of parameters reflected in error messages by a logging endpoint, and could potentially inject and...

PT-2023-20331

Name of the Vulnerable Software and Affected Versions OpenTSDB versions prior to 2.4.2 Description Insufficient validation of parameters passed to the legacy HTTP query API allows the injection of crafted OS commands into multiple parameters. This enables the execution of malicious code on the ho...

CVE-2023-25826: Improper Neutralization of Special Elements used in an OS Command

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

SUSE CVE-2020-13430

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

Metasploit Weekly Wrap-Up

Back from a quiet holiday season Thankfully, it was a relatively quiet holiday break for security this year, so we hope everyone had a relaxing time while they could. This wrapup covers the last three Metasploit releases, and contains three new modules, two updates, and five bug fixes. Make sure...