CVE-2023-41886

OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitrary file read vulnerability allows any unauthenticated user to read a file on a server. Version 3.7.5 fixes this issue.

Affected

OpenRefine

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.00% chance of exploitation in the next 30 days, 62nd percentile

Published

2023-09-15

Updated

2024-09-25

Proof-of-concept exploits (1)

• OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m

Security advisories

• advisories/GHSA-qqh2-wvmv-h72m
• OpenRefine/OpenRefine/commit/2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d

References

• CVE Record
• NVD entry