Jamie Harris

**Name of the Vulnerable Software and Affected Versions** OpenTSDB versions prior to 2.4.2 **Description** Insufficient validation of parameters passed to the legacy HTTP query API allows the injection of crafted OS commands into multiple parameters. This enables the execution of malicious code on the host system. The issue stems from an incomplete previous fix where the implemented regex validation, intended to restrict input to the query API, does not function as expected, allowing crafted commands to bypass the security check. This is an unauthenticated remote code execution (RCE) via Gnuplot injection. **Recommendations** Update to a version newer than 2.4.1.

**Name of the Vulnerable Software and Affected Versions** OpenTSDB (affected versions not specified) **Description** The issue is caused by insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint. This allows an attacker to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. The issue is related to a reflected XSS vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.