CVE Feed

    Dashboard / CVE / CVE-2024-47878

    CVE-2024-47878

    OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.

    Published:Oct 24, 2024
    Last Modified:Oct 30, 2024
    EPS:Oct 24, 2024
    EPSS Score:0.00121
    CVSS Score:8.1

    Affected Products

    Vendor
    Openrefine
    Product
    Openrefine

    Exploits

    https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-pw3x-c5vp-mfc3

    Related CVEs

    CVE-2024-49760 (CVSS 7.1) — OpenRefine is a free, open source tool for working with messy data. The load-language command expects a `lang`…
    CVE-2024-47882 (CVSS 5.9) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Some…
    CVE-2024-47881 (CVSS 8.1) — OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to …
    CVE-2024-47880 (CVSS 8.1) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `export-rows` …
    CVE-2024-47879 (CVSS 7.6) — OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site…
    CVE-2024-23833 (CVSS 7.5) — OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulne…
    CVE-2023-41887 (CVSS 9.8) — OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote …
    CVE-2023-41886 (CVSS 7.5) — OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, an arbitr…
    CVE-2022-41401 (CVSS 6.5) — OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized u…
    CVE-2023-37476 (CVSS 5.5) — OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project t…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High