Vulnerability · Published Dec 16, 2020 · Assigned by mitre
CVE-2020-35476
Critical 9.8
In plain English
A critical-severity security flaw in the net.opentsdb:opentsdb package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 85.3% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Official description
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | net.opentsdb:opentsdb | no fix listed | GHSA-hv53-q76c-7f8c |