CVE-2023-37476mediumCWE-22

CVE-2023-37476: medium-severity vulnerability in OpenRefine

Zip slip in OpenRefine

Published · Updated

Follow this CVE+ Monitor OpenRefine+ Monitor openrefine

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.6%
OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected products
OpenRefine · OpenRefine
Related CVEs — OpenRefine

In the same product, most dangerous first.

CVE-2023-41887CRITICALRemote Code exec in project import with mysql jdbc url attackEPSS 42.5%CVE-2024-23833HIGHOpenRefine JDBC Attack VulnerabilityEPSS 1.0%CVE-2023-41886HIGHOpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attackEPSS 1.0%CVE-2024-47881HIGHOpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)EPSS 0.7%CVE-2024-49760HIGHOpenRefine has a path traversal in LoadLanguageCommandEPSS 0.6%CVE-2024-47882MEDIUMOpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious projectEPSS 0.5%