High Org.openrefine CVEs
8 CVEs, 5 protected by Waratek
Overview 8 matches · 5 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
5
62.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
37.5%
blocked by ARMR today
5
62.5%
partly blocked
0
0.0%
not blocked
3
37.5%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
5
62.5%
Forecast only
0
0.0%
No public exploit
3
37.5%
split by
peak 5 / month
Jul 231
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Aug 230
Sep 231
Protected by Waratek1
High1
blocked by ARMR today1
Proof of concept only1
Oct 230
Nov 230
Dec 230
Jan 240
Feb 241
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Mar 240
Apr 240
May 240
Jun 240
Jul 240
Aug 240
Sep 240
Oct 245
Protected by Waratek2
No exploit published3
High5
blocked by ARMR today2
not blocked3
Proof of concept only4
No public exploit1
Aug 23Oct 23Dec 23Feb 24Apr 24Jun 24Aug 24Oct 24
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-49760 | High | 2024-10-24 | Protected by Waratek | No public exploit | OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. But when doing so in versions prior to 3.8.3, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. Version 3.8.3 addresses this issue. |
| CVE-2024-47881 | High | 2024-10-24 | Protected by Waratek | Proof of concept only | OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the `database` extension, the "enable_load_extension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Version 3.8.3 fixes this issue. |
| CVE-2024-47880 | High | 2024-10-24 | No exploit published | Proof of concept only | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` command can be used in such a way that it reflects part of the request verbatim, with a Content-Type header also taken from the request. An attacker could lead a user to a malicious page that submits a form POST that contains embedded JavaScript code. This code would then be included in the response, along with an attacker-controlled `Content-Type` header, and so potentially executed in the victim's browser as if it was part of OpenRefine. The attacker-provided code can do anything the user can do, including deleting projects, retrieving database passwords, or executing arbitrary Jython or Closure expressions, if those extensions are also present. The attacker must know a valid project ID of a project that contains at least one row. Version 3.8.3 fixes the issue. |
| CVE-2024-47879 | High | 2024-10-24 | No exploit published | Proof of concept only | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the `preview-expression` command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can contain arbitrary Clojure or Python code. The attacker must know a valid project ID of a project that contains at least one row, and the attacker must convince the victim to open a malicious webpage. Version 3.8.3 fixes the issue. |
| CVE-2024-47878 | High | 2024-10-24 | No exploit published | Proof of concept only | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue. |
| CVE-2024-23833 | High | 2024-02-12 | Protected by Waratek | No public exploit | OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest version of OpenRefine (8.0.30), there is no associated deserialization utilization point, so original code execution cannot be achieved, but attackers can use this vulnerability to read sensitive files on the target server. This issue has been addressed in version 3.7.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-41886 | High | 2023-09-15 | Protected by Waratek | Proof of concept only | OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue. |
| CVE-2023-37476 | High | 2023-07-17 | Protected by Waratek | No public exploit | OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources. |