PT-2023-13981 · Unknown · Openrefine

Name of the Vulnerable Software and Affected Versions: OpenRefine versions 3.5.2 and earlier Description: The issue allows unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure due to a Server-Side Request Forgery...

OpenRefine Code Issues Vulnerabilities

OpenRefine is a Java-based open source tool. The product is mainly used for loading data, analyzing data and cleaning data. A security vulnerability exists in OpenRefine 3.5.2 and earlier versions, which stems from the presence of a Server Request Forgery SSRF vulnerability. An unauthorized...

CVE-2022-41401

OpenRefine = v3.5.2 contains a Server-Side Request Forgery SSRF vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure...

CVE-2022-41401: Server-Side Request Forgery (SSRF)

OpenRefine = v3.5.2 contains a Server-Side Request Forgery SSRF vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure...

CVE-2022-41401

OpenRefine = v3.5.2 contains a Server-Side Request Forgery SSRF vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure...

Path Traversal

org.openrefine is vulnerable to Path Traversal. The vulnerability exists because the OpenRefine project tar files are not properly escaping their root directory in the untar function of FileProjectManager.java, which allows an attacker to access files outside the expected directory using relative...

OpenRefine vulnerable to zip slip in project import

Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...

GHSA-M88M-CRR9-JVQQ OpenRefine vulnerable to zip slip in project import

Impact A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it. Patches The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as...

DEBIAN-CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

UBUNTU-CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

Double free

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476

OpenRefine's CVE-2023-37476 is a documented zip-slip style vulnerability in the import mechanism for tarred OpenRefine projects. It affects all versions up to 3.7.3 and can allow arbitrary code execution in the OpenRefine process when a user imports a crafted tar file. The issue is widely referen...

CVE-2023-37476 Zip slip in OpenRefine

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476 Zip slip in OpenRefine

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476 Zip slip in OpenRefine

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

CVE-2023-37476: Improper Limitation of a Pathname to a Restricted Directory

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of...

OpenRefine 路径遍历漏洞

OpenRefine is a Java-based open source tool. The product is mainly used for loading data, analyzing data and cleaning data. A path traversal vulnerability exists in OpenRefine version 3.7.3 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...