Exploit for CVE-2020-35476

kitploit · 2026-08-25

Description

Command injection in OpenTSDB through 2.4.0 yrange parameter enabling remote code execution.

Entry point

Parameteryrange · query param

Path/q

Unauthenticated command injection through the yrange parameter in OpenTSDB (CVE-2020-35476) leading to remote code execution.

Affected Opentsdb versions

Opentsdb≤ 2.4.0

All known vulnerabilities by product

CVSS 9.8 for CVE-2020-35476

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

CVE Information

Exploit Details

Modified:2026-08-25 07:25

Last Seen:2026-08-26 06:49

Reporter:KitPloit

Tags

OpenTSDBCommand InjectionRemote Code Executionyrange Parameter

Other exploits for CVE-2020-35476

opentsdb_key_cmd_injection

2026-08-28 KitPloitKITPLOIT

Exploit for OS Command Injection in Opentsdb

2023-09-07 ErikWynterGITHUB

OpenTSDB 2.4.0 Command Injection Exploit

2022-12-24 metasploitZDTRuby

OpenTSDB 2.4.0 Command Injection

2022-12-23 Shai rod, Erik Wynter, metasploit.comPACKETSTORMRuby

OpenTSDB 2.4.0 unauthenticated command injection

2020-11-18 Shai rod, Erik WynterMETASPLOITRuby

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GLOWBASE-CVE-2020-35476
# CVE-2020-35476

OpenTSDB 2.4.0 तक एक रिमोट कोड निष्पादन कमजोरी होती है, जो yrange पैरामीटर में कमांड इंजेक्शन के माध्यम से होती है।

पूरा नहीं हुआ और काम नहीं करता। अधिकांश कोड मौजूद है लेकिन पेलोड को ठीक करना होगा।