Lucene search
PRIOn knowledge basePRION:CVE-2023-25826HistoryMay 03, 2023 - 7:15 p.m.
Input validation
2023-05-0319:15:00
PRIOn knowledge base
www.prio-n.com
9
insufficient validation
crafted os commands
http query api
malicious code
opentsdb
cve-2020-35476
incomplete fix
regex validation
Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.
Related
cvelist
cvelist
CVE-2023-25826 Remote Code Execution in OpenTSDB
2023-05-03 18:33:59
CVE-2020-35476
2020-12-16 00:00:00
osv
osv
CVE-2023-25826
2023-05-03 19:15:08
Command injection in OpenTSDB
2023-05-03 21:30:18
CVE-2020-35476
2020-12-16 08:15:13
cve
cve
CVE-2023-25826
2023-05-03 19:15:08
CVE-2020-35476
2020-12-16 08:15:13
nvd
nvd
CVE-2023-25826
2023-05-03 19:15:08
CVE-2020-35476
2020-12-16 08:15:13
github
github
Command injection in OpenTSDB
2023-05-03 21:30:18
OS Command Injection in OpenTSDB
2021-08-02 17:02:21
packetstorm
packetstorm
OpenTSDB 2.4.0 Command Injection
2022-12-23 00:00:00
OpenTSDB 2.4.1 Unauthenticated Command Injection
2023-09-08 00:00:00
checkpoint_advisories
checkpoint_advisories
StumbleUpon OpenTSDB Remote Code Execution (CVE-2020-35476)
2021-02-10 00:00:00
nuclei
nuclei
OpenTSDB <=2.4.0 - Remote Code Execution
2021-01-31 17:35:32
zdt
zdt
OpenTSDB 2.4.0 Command Injection Exploit
2022-12-24 00:00:00
OpenTSDB 2.4.1 Unauthenticated Command Injection Exploit
2023-09-11 00:00:00
prion
prion
Remote code execution
2020-12-16 08:15:00
metasploit
metasploit
OpenTSDB 2.4.0 unauthenticated command injection
2022-11-24 19:37:24
OpenTSDB 2.4.1 unauthenticated command injection
2023-09-07 14:29:16
veracode
veracode
Command Injection
2023-05-09 05:46:21
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2023-01-06 21:32:44
Metasploit Weekly Wrap-Up
2023-09-15 18:54:45
wallarmlab
wallarmlab
ChatGPT: Friend or Foe? | API Security Newsletter
2023-05-16 13:58:20