PT-2018-11505 · Opentsdb · Opentsdb

Mikeluengo · Publicado 2018-06-29 · Atualizado 2022-05-13 · CVE-2018-12972

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenTSDB version 2.3.0

Description An issue was discovered where many parameters to the "/q" URI can execute commands. The vulnerable parameters include o, key, style, and yrange and y2range along with their JSON input.

Recommendations For OpenTSDB version 2.3.0, consider restricting access to the "/q" URI or limiting the execution of commands through the vulnerable parameters o, key, style, yrange, and y2range to minimize the risk of exploitation. Avoid using these parameters with JSON input until the issue is resolved.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-12972

GHSA-CX2V-JRJC-G54W

Produtos afetados

Opentsdb

Referências · 5

• https://github.com/OpenTSDB/opentsdb/issues/1239 · Nota
• https://github.com/OpenTSDB/opentsdb · Nota
• https://osv.dev/vulnerability/GHSA-cx2v-jrjc-g54w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12972 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-12972 · Aviso do Fabricante