CVE-2023-36812

OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.

• CWE-74

• http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
• https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9Patch
• https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309baPatch
• https://github.com/OpenTSDB/opentsdb/security/advisories/GHSA-76f7-9v52-v2fwPatch
• http://packetstormsecurity.com/files/174570/OpenTSDB-2.4.1-Unauthenticated-Command-Injection.html
• https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9Patch
• https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309baPatch
• https://github.com/OpenTSDB/opentsdb/security/advisories/GHSA-76f7-9v52-v2fwPatch

Published

Jun 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36807pypdf is a pure-python PDF library capable of splitting, mer…6.5
• CVE-2023-36808GLPI is a free asset and IT management software package. Sta…9.8
• CVE-2023-36809Kiwi TCMS, an open source test management system allows user…5.4
• CVE-2023-3681A vulnerability classified as problematic was found in Campc…6.1
• CVE-2023-36810pypdf is a pure-python PDF library capable of splitting, mer…6.5
• CVE-2023-36811borgbackup is an opensource, deduplicating archiver with com…4.7
• CVE-2023-36813Kanboard is project management software that focuses on the …8.8
• CVE-2023-36814Products.CMFCore are the key framework services for the Zope…7.5
• CVE-2023-36815Sealos is a Cloud Operating System designed for managing clo…8.1
• CVE-2023-368162FA is a Web app to manage Two-Factor Authentication (2FA) a…6.1
• CVE-2023-36817`tktchurch/website` contains the codebase for The King's Tem…9.1
• CVE-2023-36818Discourse is an open source discussion platform. In affected…7.5