CVE-2018-20157

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2018-20157

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20157.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-20157

Published

2018-12-15T00:29:00.317Z

Modified

2025-11-20T10:48:43.193512Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.

References

https://github.com/OpenRefine/OpenRefine/issues/1907

Affected packages

Git / github.com/openrefine/openrefine

Affected ranges

Type: GIT
Repo: https://github.com/openrefine/openrefine
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

b90e413b404e6ca7e2b3351db773fe189c1a2a65

Affected versions

1.*

1.1

2.*

2.6-alpha.2

2.6-alpha1

2.6-beta.1

2.6-rc.2

2.7

2.7-rc.1

2.7-rc.2

2.8

3.*

3.0

3.0-beta

3.0-rc.1

3.1

3.1-beta

v2.*

v2.6-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20157.json"