diff --git a/cves/2020/CVE-2020-35476.yaml b/cves/2020/CVE-2020-35476.yaml index 9e52724eca..4ab051e8a6 100644 --- a/cves/2020/CVE-2020-35476.yaml +++ b/cves/2020/CVE-2020-35476.yaml @@ -5,11 +5,11 @@ info: author: pikpikcu severity: critical description: | - OpenTSDB through 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory. + OpenTSDB 2.4.0 and earlier is susceptible to remote code execution via the yrange parameter written to a gnuplot file in the /tmp directory. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. reference: - https://github.com/OpenTSDB/opentsdb/issues/2051 - - https://nvd.nist.gov/vuln/detail/CVE-2020-35476 - http://packetstormsecurity.com/files/170331/OpenTSDB-2.4.0-Command-Injection.html + - https://nvd.nist.gov/vuln/detail/CVE-2020-35476 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -44,3 +44,5 @@ requests: - type: status status: - 200 + +# Enhanced by md on 2023/02/01