Zip slip in OpenRefine
CVE-2023-37476

5.5MEDIUM

Key Information:

Vendor

Openrefine

Status
Openrefine
Vendor
CVE Published:
17 July 2023

What is CVE-2023-37476?

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

Affected Version(s)

OpenRefine < 3.7.4

References

https://github.com/OpenRefine/OpenRefine/security/advisor...
x_refsource_CONFIRM
https://github.com/OpenRefine/OpenRefine/commit/e9c1e65d5...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.