Description
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
Remediation
References
https://github.com/OpenTSDB/opentsdb/issues/1239
Related Vulnerabilities
CVE-2016-10665 Vulnerability in npm package herbivore
CVE-2023-26136 Vulnerability in maven package org.webjars.bowergithub.salesforce:tough-cookie
CVE-2014-0085 Vulnerability in maven package org.apache.zookeeper:zookeeper
CVE-2019-16942 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2016-3081 Vulnerability in maven package org.apache.struts:struts2-core