CVE-2022-41401

2023-08-0417:15:09

Google

osv.dev

openrefine

ssrf

vulnerability

unauthorized access

sensitive file disclosure

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.7%

JSON

OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.

CPENameOperatorVersion
openrefineeq3.5-beta1
openrefineeq3.3-beta
openrefineeq2.6-alpha.2
openrefineeq3.5.1
openrefineeq3.2-beta
openrefineeq3.3-rc1
openrefineeq3.5.2
openrefineeq3.3
openrefineeq2.6-rc.2
openrefineeq3.5-beta2

Name	Operator	Version
openrefine	eq	3.5-beta1
openrefine	eq	3.3-beta
openrefine	eq	2.6-alpha.2
openrefine	eq	3.5.1
openrefine	eq	3.2-beta
openrefine	eq	3.3-rc1
openrefine	eq	3.5.2
openrefine	eq	3.3
openrefine	eq	2.6-rc.2
openrefine	eq	3.5-beta2

Rows per page:

1-10 of 261

References

github.com/ixSly/CVE-2022-41401

github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/ImportingUtilitiesTests.java#L180

github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtilities.java#L103