PT-2025-47607 · Unknown · Open Ondemand

Published 2025-11-20 · Updated 2025-11-21 · CVE-2025-64185

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Open OnDemand versions prior to 4.0.8 Open OnDemand versions prior to 3.1.16

Description Open OnDemand packages create world writable locations in the GEM PATH prior to versions 4.0.8 and 3.1.16. This could allow unauthorized modification of files in the GEM PATH.

Recommendations Update to Open OnDemand version 4.0.8 or later. Update to Open OnDemand version 3.1.16 or later.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-277

CWE-552

Related Identifiers

CVE-2025-64185

GHSA-R2CG-HG78-GQ9P

Affected Products

Open Ondemand

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64185.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64185 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64185 · Vendor Advisory
• https://github.com/OSC/ondemand/security/advisories/GHSA-r2cg-hg78-gq9p · Note
• https://twitter.com/VulmonFeeds/status/1991663083526275355 · Twitter Post
• https://t.me/CVEtracker/37846 · Telegram Post
• https://twitter.com/CVEnew/status/1991555610836410481 · Twitter Post