The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template.
References
| Link | Resource |
|---|---|
| https://discourse.osc.edu/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198 | Release Notes Vendor Advisory |
| https://github.com/OSC/Open-OnDemand/commits/master | Release Notes Third Party Advisory |
| https://listsprd.osu.edu/pipermail/ood-users/ | Broken Link Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Jul 2022, 17:42
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-116 |
14 Mar 2022, 13:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:osu:ohio_supercomputer_center_open_ondemand:*:*:*:*:*:*:*:* | |
| CWE | CWE-732 | |
| First Time |
Osu ohio Supercomputer Center Open Ondemand
Osu |
|
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| References | (MISC) https://github.com/OSC/Open-OnDemand/commits/master - Release Notes, Third Party Advisory | |
| References | (MISC) https://listsprd.osu.edu/pipermail/ood-users/ - Broken Link, Vendor Advisory | |
| References | (CONFIRM) https://discourse.osc.edu/t/security-fix-in-open-ondemand-1-8-18-and-1-7-19-patch-releases-now-available/1198 - Release Notes, Vendor Advisory |
26 Feb 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-26 20:15
Updated : 2023-12-10 14:22
NVD link : CVE-2020-27958
Mitre link : CVE-2020-27958
CVE.ORG link : CVE-2020-27958
JSON object : View
Products Affected
osu
- ohio_supercomputer_center_open_ondemand
CWE
CWE-116
Improper Encoding or Escaping of Output