CVE-2023-36812

Summary

CVE-2023-36812 is a Remote Code Execution vulnerability affecting OpenTSDB, an open-source Time Series Database. The issue lies in the application's handling of user-controlled input written to a Gnuplot configuration file, which can be exploited to run malicious commands. The vulnerability has been addressed in commits `07c4641471c` and `fa88d3e4b`, which are incorporated in the `2.4.2` release. It is strongly recommended that users upgrade to the latest version. Those unable to upgrade can mitigate the risk by disabling Gunuplot and removing associated shell files.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.