Open OnDemand vulnerabilities

Open OnDemand (an HPC portal) before versions 4.0.11, 4.1.5, and 4.2.2 allows specially crafted filenames to execute JavaScript in the file browser. Fixed in 4.0.11, 4.1.5, and 4.2.2.

Open OnDemand, an HPC portal, in versions prior to 4.0.8 and 3.1.16 creates world-writable locations in the GEM_PATH, potentially allowing unauthorized modifications.

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a Time of Check to Time of Use (TOCTOU) attack when downloading zip files to access files outside of the OOD_ALLOWLIST. Files accessed are still protected by UNIX permissions.