CVE-2025-53636: fallo de gravedad media en OSC ondemand
Open OnDemand Shell App closed websocket DoS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.3%
Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Productos afectados
OSC · ondemandCVEs relacionadas — OSC ondemand
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-26002MEDIUMOnDemand susceptible to malicious input when navigating to a directory.EPSS 0.6%CVE-2025-64185MEDIUMOpen OnDemand RPM packages create world writable locationsEPSS 0.3%CVE-2025-58435MEDIUMOpen OnDemand didn't rotate password for VNC batch_connectEPSS 0.3%CVE-2026-44371MEDIUMOpen OnDemand: Specially crafted filenames can execute javascript in the file browserEPSS 0.3%CVE-2025-62724MEDIUMOpen OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)EPSS 0.2%CVE-2025-66029HIGHOpen OnDemand affected by Apache proxy passing sensitive headersEPSS 0.2%