CVE-2018-12972

OpenTSDB 2.3.0 is affected by CVE-2018-12972. The /q endpoint accepts many parameters (o, key, style, yrange, y2range, and their JSON input) that can be used to execute arbitrary commands, enabling remote code execution. Public advisories (GHSA-CX2V-JRJC-G54W and OSV/Veracode entries) describe th...