Open XDMoD vulnerabilities

Open XDMoD versions 9.5.0 through 11.0.2 contain a vulnerability allowing remote arbitrary system command execution on the web server. An attacker can execute commands with the privileges of the web server process.

An authentication bypass issue was discovered in Open XDMoD through version 7.5.0, which can lead to account takeover. A weak password reset mechanism allows an attacker to perform a brute-force attack on the MD5 rid value, requiring only 600 guesses if they know the victim initiated a password reset process in the past few minutes.

Open XDMoD before version 11.0.3 has a flaw in access control logic that allows an attacker to send a crafted HTTPS POST request setting a session variable used for authorization. If the optional Job Performance (SUPReMM) module is installed, the attacker can bypass data access restrictions and view other users' compute job efficiency metrics.