PT-2025-47604 · Unknown · Open Ondemand

Published 2025-11-20 · Updated 2025-11-21 · CVE-2025-62724

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open OnDemand versions prior to 4.0.8 Open OnDemand versions prior to 3.1.16

Description Open OnDemand is an open-source HPC portal. Users can potentially exploit a “Time of Check to Time of Use” (TOCTOU) condition when downloading zip files, allowing access to files outside of the OOD ALLOWLIST. This affects installations utilizing file browser allowlists. While files are accessed, UNIX permissions still apply to protect them.

Recommendations Update to Open OnDemand version 4.0.8 or later. Update to Open OnDemand version 3.1.16 or later.

Exploit

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-61

CWE-367

Related Identifiers

CVE-2025-62724

GHSA-VJPG-34PX-GJRW

Affected Products

Open Ondemand

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62724.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62724 · Security Note
• https://github.com/OSC/ondemand/security/advisories/GHSA-vjpg-34px-gjrw · Note
• https://t.me/CVEtracker/37843 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991670763129073713 · Twitter Post
• https://twitter.com/CVEnew/status/1991555611968827586 · Twitter Post