PT-2022-8879 · Ohio Supercomputer Center · Open Ondemand

Radoslav Bodó · Published 2022-02-26 · Updated 2022-07-12 · CVE-2020-27958

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ohio Supercomputer Center Open OnDemand versions 1.7.19 and earlier Ohio Supercomputer Center Open OnDemand versions 1.8.x through 1.8.17

Description The Job Composer app allows remote authenticated users to provide crafted input in a job template.

Recommendations For versions 1.7.19 and earlier, update to version 1.7.19 or later. For versions 1.8.x through 1.8.17, update to version 1.8.18 or later.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2020-27958

Affected Products

Open Ondemand

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-27958 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27958 · Vendor Advisory
• https://discourse.osc.edu/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198 · Vendor Advisory
• https://listsprd.osu.edu/pipermail/ood-users · Vendor Advisory
• https://github.com/OSC/Open-OnDemand/commits/master · Note
• https://t.me/cibsecurity/38162 · Telegram Post
• https://t.me/cvenotify/27439 · Telegram Post