CVE-2023-36812
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
OpenTSDB, an open-source, distributed time series database, is vulnerable to remote code execution by writing user-controlled input to a Gnuplot configuration file and running Gnuplot with the generated configuration.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution on the server, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to upgrade to version 2.4.2, which includes patches. Users unable to upgrade should disable Gnuplot in the configuration options and remove the shell files.
Original NVD description (English source)
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.