Command injection in OpenTSDB - CVE-2018-12972
Published: August 22, 2018 / Updated: August 23, 2018
Vulnerability identifier: #VU14511
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-12972
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: OpenTSDB
Affected software:
OpenTSDB
OpenTSDB
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper setting of security restrictions on o, key, style, yrange, and y2range parameters and their JSON input to the /q URI A remote unauthenticated attacker can send a specially crafted request that submits malicious input and execute arbitrary commands.
How to mitigate CVE-2018-12972
Update to version 2.3.1.