{"id":"CVE-2023-36812","summary":"Remote Code Execution in OpenTSDB","details":"OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in  commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.","aliases":["GHSA-76f7-9v52-v2fw"],"modified":"2026-08-12T13:32:39.813118Z","published":"2023-06-30T22:58:33.603Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-74"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36812.json","unresolved_ranges":[{"extracted_events":[{"fixed":"2.4.2"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36812.json"},{"type":"ADVISORY","url":"https://github.com/OpenTSDB/opentsdb/security/advisories/GHSA-76f7-9v52-v2fw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36812"},{"type":"FIX","url":"https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"},{"type":"FIX","url":"https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opentsdb/opentsdb","events":[{"introduced":"0"},{"fixed":"07c4641471c6f5c2ab5aab615969e97211eb50d9"},{"fixed":"fa88d3e4b5369f9fb73da384fab0b23e246309ba"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.2.2","v2.3.0","v2.2.1","v2.1.3","v2.2.0","v2.1.4","v2.1.2","2.1.1","v2.1.0","v2.0.1","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-36812.json","vanir_signatures_modified":"2026-08-12T13:32:39Z","vanir_signatures":[{"digest":{"line_hashes":["285202655282756513307212215982219689355","244800964684257996843248949425225681164","219078161650577279921772228174824557290","22044013831201765401686392379959509243","215587230347243490744611364667676837975","29174065763775148327177767930584572798","8049774749977460216726574016028368222","201965185109804557666128046412361707437","77199835893924967166776717566267447442","159211164572169532757118555248200119338","254810970286137399730375470287438578764","253874946323839971712491433181564066792","206853622386607824545630016406107546448","55865028367236032398933663795090234177","52689202939698420593857978878100276494","304011581363000454509777055364975819417","65685398694743008221281464335396866482","206402944901338814905241992855999615518","258809562578289227315481029373648222475","44514728979303328440103490280077472626","198128856343668079525482667279868769269","275374281438835549068180158911912243738","167605360563319658355033064687059274159","238668373690910294252642542611808481665","12901879534002328549349611597414166990","117823180168229884414646346893680578598","92363071733549284495244828539930632071","16578065039662660745068718450498286348","335390060638516215661893390174505684444","158844076480539371570799654643504590097","126764741698356993348869696845360990137","264329965830401965480588779846327060555","11658199455804319490807989647984921787","38603791682005797835653765712578831525","202387206219448401306550762048190039476","201838894367636382228532839532654797685","327818240365928256701379127135245120544","255532338120353862517737180185153967823","114088867515209568476613314276962888597","314123526266895566843748524485136622657","227467890341885814197688077652126606306"],"threshold":0.9},"id":"CVE-2023-36812-02f50aa3","signature_type":"Line","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"test/tsd/TestGraphHandler.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"test/tsd/TestGraphHandler.java","function":"setColorParams"},"deprecated":false,"digest":{"function_hash":"21754829914766377546711673879702972947","length":419},"id":"CVE-2023-36812-23c9254f"},{"digest":{"function_hash":"27077658475689427864114023710442145232","length":1025},"id":"CVE-2023-36812-43041398","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"src/tsd/GraphHandler.java","function":"setPlotDimensions"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["264051637920165470388469687109506848937","194693718344945341063401059045885035198","249794771533729342001205197609228904012","194063691775372249279401498310218264111","174624925070500561395114778698821563899","296904470637393212012488041934032554613","8517316072420935692389666635541489908","311198637783724423561459442912919492469","79537736603349184880819695059537653570","203904963847569766571486068741684045827","79862756005635048796563360613357018319","234965298343419926973768026606369407850","176606191003893997169526838350133997157","333171026834290007105922263582887093747","52184209272142307415358449636516934299","110459351960663457487790672482860272416","134514544486965743150110695167775596980","144830052858107903001580396516571553861","114854159445608463982587929414118835811"],"threshold":0.9},"id":"CVE-2023-36812-4fe079cd","signature_type":"Line","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"src/tsd/HttpQuery.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"src/tsd/GraphHandler.java"},"deprecated":false,"digest":{"line_hashes":["282218780449616240821229740485716568729","276502175418169904001576021257269887381","126967492264308522395216210792490365181","236505796892167241472735142811652978087","42671112636517165908345155773303648825","274484958069145634558957689981810700221","82121854218539297564754959716754191984","313318846609669917121214104529703936673","80019184508868751185173908392496836890","32252142403705032340977218010810361191","333283890091121713700008891827109575361","164457740080635168716048355119344584695","8181913099440605734563125047045734456","111560060589432318692303324954114579111","240662222128014205731427491240987574858","67759784071545677119407193595107933238","278556178063019472374121721906644124097","216273379001448334120392093971080334707","174814644730524252735419170347979465960","333971804004295962420211788590307626329","324531774824290241695900830146189407082","323116654415399401040672042826272340604","152485557191326442582651824272901723633","184571356151611760286703706278101361798","55785108733464890834786319832684984952","77300940614840504226053351144517285841","172422398475649872377833229864496672243","238448356077911994143773187290029835774","37831769799356177377256921317323742174","195461172629765935098269454255736169012","19203291509656366273313449397526695263","240833663108843680457345694281267956175","73948075097641137535104619717812461837","33691207340390175259347838707820928134","201797979185516883033827145139936138900","170541490996032751232472572087321972099","13211921586949809323897091523229955346","196232003687109746834311757665501727204","135265267844498773803719850183808286283","38353040625896941971818209364478713200","325111488902486654914598351215336291953","231237313527770099621973640292070883134","275252776310866446950135073268259161467","208288704984503080233011385452908576945","337944540852088052410407699421762037023","190990492101487600901410772369890457125","14098171808583486733876279613303791796","195301944416269462853780404757228695331","189583983178865158766986056974937056333","116432609072707566496166516295592413268","307109771444463732055575426206165216744","238846974536083295414966100026475702435","324534364065091361524854944283415155598","246330869647463891907945026027374216790","77344423834517056445242611975876934304","215634524385136322730926037608717011854","208618839460857847051641235199855252606","316207394798350820713767141655140408653","41204392788121509581866538743853768386","114342185068482704857817357149808424408","196975052337040237893094386621845906121","253422688565920648447780634000332304683","186010156314907406463865252719555026504","111399174515101782173947878955312386812","25414882461940840742087332158164176518","196506656092119566691740203254683733242","321068784262949843099676780728353295035","20852327650146862062907274613158026335"],"threshold":0.9},"id":"CVE-2023-36812-5288495b"},{"signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"test/tsd/TestGraphHandler.java","function":"setSmoothParams"},"deprecated":false,"digest":{"function_hash":"10262682517849209759710316944765240038","length":552},"id":"CVE-2023-36812-5617cc5d","signature_type":"Function"},{"id":"CVE-2023-36812-7725a144","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"src/tsd/HttpQuery.java","function":"internalError"},"deprecated":false,"digest":{"function_hash":"303583127088162215664436438165782077877","length":1025}},{"digest":{"threshold":0.9,"line_hashes":["296611036381030638682429294095846790401","329408185650132167798941418402631149045","289451997690361157119423739586646468331","35587530887446325263204751996200074112","296611036381030638682429294095846790401","329408185650132167798941418402631149045","289451997690361157119423739586646468331","194077103581407549244544965984008630883"]},"id":"CVE-2023-36812-b29a8539","signature_type":"Line","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"test/tsd/TestQueryRpc.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"139151306512976608862140524397689000129","length":261},"id":"CVE-2023-36812-ccac0647","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"test/tsd/TestGraphHandler.java","function":"setLabelParams"}},{"digest":{"function_hash":"232233079236879369671876382984267413639","length":678},"id":"CVE-2023-36812-cccf2e76","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"test/tsd/TestQueryRpc.java","function":"executeNSU"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"src/tsd/HttpQuery.java","function":"badRequest"},"deprecated":false,"digest":{"function_hash":"84255967637691111234381416621389283879","length":912},"id":"CVE-2023-36812-d2209620"},{"deprecated":false,"digest":{"length":3945,"function_hash":"175099909058282180819932364194410164631"},"id":"CVE-2023-36812-d7919627","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"src/tsd/GraphHandler.java","function":"setPlotParams"}},{"id":"CVE-2023-36812-d80eed02","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"file":"test/tsd/TestGraphHandler.java","function":"setYRangeParams"},"deprecated":false,"digest":{"function_hash":"220455661772262214829259422726919623161","length":1151}},{"target":{"file":"test/tsd/TestGraphHandler.java","function":"setKeyParams"},"deprecated":false,"digest":{"function_hash":"170049736537727174186095198654561505063","length":360},"id":"CVE-2023-36812-da2819ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"},{"target":{"file":"test/tsd/TestGraphHandler.java","function":"setStyleParams"},"deprecated":false,"digest":{"length":227,"function_hash":"115953092585376297506831464315042248890"},"id":"CVE-2023-36812-e2e1d5d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9"},{"deprecated":false,"digest":{"function_hash":"204393985823783998998801262485102761910","length":358},"id":"CVE-2023-36812-f9a58d0b","signature_type":"Function","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9","target":{"function":"setFormatParams","file":"test/tsd/TestGraphHandler.java"}},{"deprecated":false,"digest":{"line_hashes":["133055113987216306629635457172086281959","318249663440861099704938746935406624271","35919350242276400757561628451073766767","233258021618676197940889644044378508100","133055113987216306629635457172086281959","318249663440861099704938746935406624271","233838425573375376779338654687688386847","98557901631851644301013118807935548226"],"threshold":0.9},"id":"CVE-2023-36812-fe4a3fce","signature_type":"Line","signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"test/tsd/TestHttpQuery.java"}},{"signature_version":"v1","source":"https://github.com/opentsdb/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba","target":{"file":"test/tsd/TestQueryRpc.java","function":"postQueryNoMetricBadRequest"},"deprecated":false,"digest":{"function_hash":"168576425543258222220647695343962120943","length":796},"id":"CVE-2023-36812-feafd4cd","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}