Remote Code exec in project import with mysql jdbc url attack
CVE-2023-41887

9.8CRITICAL

Key Information:

Vendor

OpenRefine

Status
OpenRefine
Vendor
CVE Published:
15 September 2023

What is CVE-2023-41887?

OpenRefine, an open source tool designed for processing messy data, contains a vulnerability that allows an unauthenticated user to execute arbitrary code on the server prior to version 3.7.5. This poses significant security risks as it enables attackers to manipulate server-side applications without authentication, making it essential for users to update to the patched version to mitigate potential threats.

Affected Version(s)

OpenRefine <= 3.7.4

References

https://github.com/OpenRefine/OpenRefine/security/advisor...
x_refsource_CONFIRM
https://github.com/OpenRefine/OpenRefine/commit/693fde606...
x_refsource_MISC

EPSS Score

59% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.