OpenRefineGHSA-qfwq-6jh6-8xx4
OpenRefine has a path traversal in LoadLanguageCommand
High7.1CVE-2024-49760 · Published Oct 24, 2024 · updated Nov 6, 2024
The load-language command expects a `lang` parameter from which it constructs the path of the localization file to load, of the form `translations-$LANG.json`. When doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to read other JSON files on the file system. The command should be patched by checking that the normalized path is in the expected directory.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.openrefine:openrefine Maven | < 3.8.3 | 3.8.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2024-49760
More OpenRefine advisories
All OpenRefine| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 242024 | OpenRefine leaks Google API credentials in releases HighOct 24, 2024 | High | 3.8.3 |
| Oct 242024 | OpenRefine: cross-site scriptingMedium5.9Oct 24, 2024 | Medium5.9 | 3.8.3 |
| Oct 242024 | OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommandHigh8.1Oct 24, 2024 | High8.1 | 3.8.3 |