CVE-2023-37476

HIGH EPSS 45.7%
Published Jul 17, 20232y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Jul 17, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution in the context of the OpenRefine process if a user can be convinced to import it. The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible. Users unable to upgrade should only import OpenRefine projects from trusted sources.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
45.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

Affected Products 1

VendorProductVersionRange
openrefineopenrefine* ≤3.7.3

References 4

  • github.com https://github.com/OpenRefine/OpenRefine/commit/e9c1e65d58b47aec8cd676bd5c07d97b002f205e
    Patch
  • github.com https://github.com/OpenRefine/OpenRefine/releases/tag/3.7.4
  • github.com https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-m88m-crr9-jvqq
    Vendor Advisory
  • sonarsource.com https://www.sonarsource.com/blog/openrefine-zip-slip

Remediation

  • github.com https://github.com/OpenRefine/OpenRefine/commit/e9c1e65d58b47aec8cd676bd5c07d97b002f205e
    Patch