CVE-2020-35476
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 85%
from disclosure to weapon410 days
Published on NVDDec 16
1st PoC+410d
metasploitNov 18
VulnCheck+1131d
exploitation probability
85%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Affected products
n/a · n/apublic PoCs found — 1
vulncheckvulncheck.com/xdb/765cb871004bunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.