OpenTSDB <= 2.4.1 - Unauthenticated RCE via Gnuplot Injection

OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters. id: CVE-2023-25826 info: name: OpenTSDB = 2.4.1 -...

opentsdb_key_cmd_injection

opentsdbkeycmdinjection An exploit for OpenTSDB = 2.4.1 cmd injection CVE-2023-36812/CVE-2023-25826 written in Fortran About This is an exploit for a command injection vulnerability in OpenTSDB verions 2.4.1 and prior CVE-2023-36812/CVE-2023-25826. The exploit is written in modern Fortran and...

CVE-2020-35476

CVE-2020-35476 A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. Not finished and doesn't work. Most of the code is there but payload has to be fixed...

OpenTSDB <=2.4.0 - Remote Code Execution

OpenTSDB 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

OpenTSDB 2.4.0 Gnuplot Command Injection

OpenTSDB versions through 2.4.0 contain a command injection vulnerability in the graph endpoint yrange parameter, allowing Gnuplot system execution. A proof of concept is included. https://packetstorm.news/download/234990...

Exploit for OS Command Injection in Opentsdb

OpenTSDB Gnuplot Command Injection CVE-2020-35476 Vulhub...

OpenTSDB - Detect

OpenTSDB stats exposed which is commonly used in monitoring and observability scenarios where tracking and analyzing the performance of systems, applications, and infrastructure over time is essential. !/usr/bin/env python3 -- coding: utf-8 -- """OpenTSDB stats exposed which is commonly used in...

EUVD-2023-1514

Malicious code in bioql PyPI...

EUVD-2022-3129

Malicious code in bioql PyPI...

EUVD-2022-5110

Malicious code in bioql PyPI...

EUVD-2022-3028

Malicious code in bioql PyPI...

EUVD-2022-3656

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-13430

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. CVE-2020-13430 Note that Nessus relies on the presence of the package as reported by the...

CVE-2023-36812

OpenTSDB is a open source, distributed, scalable Time Series Database TSDB. OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit...

CVE-2023-25827

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2020-35476

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. tsd/GraphHandler.java attempted to prevent comma...

Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang: net: malformed DNS message can cause infinite loop CVE-2024-24788 golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip:...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34156 dompurify:...

ALSA-2024:9115 Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang: net: malformed DNS message can cause infinite loop CVE-2024-24788 golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip:...

ALSA-2024:8678 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 For more details about the security issues, includi...