XML External Entity Vulnerability in OpenRefine by OpenRefine
CVE-2018-20157

7.5HIGH

Key Information:

Vendor

Openrefine

Status
Openrefine
Vendor
CVE Published:
15 December 2018

What is CVE-2018-20157?

The data import functionality in OpenRefine 3.1 is susceptible to an XML External Entity (XXE) attack. By using a specially crafted zip file, an attacker can exploit this vulnerability, leading to the potential exposure of sensitive files on the server. This poses significant risks for data integrity and confidentiality, as it allows unauthorized access to arbitrary files, which could be used for further exploitation.

References

https://github.com/OpenRefine/OpenRefine/issues/1907
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.