Critical severity9.8NVD Advisory· Published Jun 30, 2023· Updated Jun 17, 2026
CVE-2023-36812
CVE-2023-36812
Description
OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit 07c4641471c and further refined in commit fa88d3e4b. These patches are available in the 2.4.2 release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config optiontsd.core.enable_ui = true and remove the shell files mygnuplot.bat and mygnuplot.sh.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
net.opentsdb:opentsdbMaven | < 2.4.2 | 2.4.2 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9nvdPatchWEB
- github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309banvdPatchWEB
- github.com/OpenTSDB/opentsdb/security/advisories/GHSA-76f7-9v52-v2fwnvdPatchWEB
- github.com/advisories/GHSA-76f7-9v52-v2fwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-36812ghsaADVISORY
- packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.htmlnvdWEB
News mentions
0No linked articles in our index yet.