CVE-2023-37476

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-37476
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-37476.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-37476
Aliases
Related
Published
2023-07-17T22:15:09Z
Modified
2024-11-24T16:48:05.353242Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

References

Affected packages

Debian:12 / openrefine

Package

Name
openrefine
Purl
pkg:deb/debian/openrefine?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6.2-2+deb12u1

Affected versions

3.*

3.6.2-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/openrefine/openrefine

Affected ranges

Type
GIT
Repo
https://github.com/openrefine/openrefine
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e9c1e65d58b47aec8cd676bd5c07d97b002f205e

Affected versions

1.*

1.1

2.*

2.6-alpha.2
2.6-alpha1
2.6-beta.1
2.6-rc.2
2.7
2.7-rc.1
2.7-rc.2
2.8

3.*

3.0
3.0-beta
3.0-rc.1
3.1
3.1-beta
3.2
3.2-beta
3.3
3.3-beta
3.3-rc1
3.4-beta
3.5-beta1
3.7-beta2

v2.*

v2.6-rc1