Description

OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, potentially leading to unauthorized access to internal resources and sensitive file disclosure.

Remediation

References

https://github.com/OpenRefine/OpenRefine/blob/30d6edb7b6586623bda09456c797c35983fb80ff/main/tests/server/src/com/google/refine/importing/ImportingUtilitiesTests.java#L180

https://github.com/OpenRefine/OpenRefine/blob/cb55cdfdf6f9ca916839778dc847cce803688998/main/src/com/google/refine/importing/ImportingUtilities.java#L103

https://github.com/ixSly/CVE-2022-41401

Related Vulnerabilities

CVE-2016-10566 Vulnerability in npm package install-nw

CVE-2023-37945 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp

CVE-2021-43571 Vulnerability in npm package starkbank-ecdsa

CVE-2021-41183 Vulnerability in maven package org.webjars.bower:jquery-ui

CVE-2023-34455 Vulnerability in maven package org.xerial.snappy:snappy-java

Severity

High

Classification

CWE-918 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Exploit