CVE-2023-25826

Name of the Vulnerable Software and Affected Versions OpenTSDB versions prior to 2.4.2

Description Insufficient validation of parameters passed to the legacy HTTP query API allows the injection of crafted OS commands into multiple parameters. This enables the execution of malicious code on the host system. The issue stems from an incomplete previous fix where the implemented regex validation, intended to restrict input to the query API, does not function as expected, allowing crafted commands to bypass the security check. This is an unauthenticated remote code execution (RCE) via Gnuplot injection.

Recommendations Update to a version newer than 2.4.1.