CVE-2024-23833

OpenRefine is a free, open source power tool for working with messy data
and improving it. A jdbc attack vulnerability exists in
OpenRefine(version<=3.7.7) where an attacker may construct a JDBC query
which may read files on the host filesystem. Due to the newer MySQL driver
library in the latest version of OpenRefine (8.0.30), there is no
associated deserialization utilization point, so original code execution
cannot be achieved, but attackers can use this vulnerability to read
sensitive files on the target server. This issue has been addressed in
version 3.7.8. Users are advised to upgrade. There are no known workarounds
for this vulnerability.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064192&gt;