Description
An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
Remediation
References
https://github.com/OpenTSDB/opentsdb/issues/1239
Related Vulnerabilities
CVE-2020-2268 Vulnerability in maven package org.jenkins-ci.plugins:mongodb
CVE-2022-1466 Vulnerability in maven package org.keycloak:keycloak-core
CVE-2022-31160 Vulnerability in maven package org.fujion.webjars:jquery-ui
CVE-2020-13445 Vulnerability in maven package com.liferay:com.liferay.portal.template.velocity
CVE-2023-37962 Vulnerability in maven package io.jenkins.plugins:benchmark-evaluator